Splunk Search

Removing null columns from a table

Path Finder

I've found some previous posts with similar questions but the results dont seem to be correct so I'm hoping someone can help with this one...

I have something like this:
mysearch | table column1 column2 column3

With results like this:
column1 --- column2 --- column 3
asdfasdf --- 123456
bsdfasdf --- 234567
csdfasdf --- 345678

Sometimes column3 will have data, sometimes it wont. How (after piping to table) can I remove column3 if it has no data (and preferably keep the columns in order as well)? Thanks.

Motivator

I downvoted this post because this doesn't answer the question.

0 Karma

New Member

Above answer is not working in splunk 6.5 version

0 Karma

Path Finder

This should be a comment to the mentioned answer rather than another 'answer'. Very misleading as the order of answers changes.

0 Karma

Champion

If you don't want to show column 3, don't include it in your table command.

Other than that, how do you think it would work? You can either have a column or don't have it, but you can't have it in some results only - although in a way, that is exactly what happens with a row which is empty in column 3 - it doesn't have a value for column 3. If you could try to show me an example of how the table would look like the way you want it, that would be great.

If you don't want to display empty fields, you could use

your search | table column1 column2 column3 | fillnull column3 ("No entry for column 3")

to have them display that text instead.

0 Karma

Path Finder

@jeffland, this is a comment, not an answer. can you delete this as an answer?

"...how do you think it would work?" That's what i'm asking.

I want to include it in the table b/c it may have data. I want to include all columns that may have data. Then remove the column if it does not have data.

0 Karma

Champion

Let me rephrase that question: What do you want to see?

I can't imagine how a table would look that has a third column sometimes and sometimes it doesn't. Should the first page of results contain such a column while the second page doesn't?

0 Karma

Communicator

So when you do the search column 3 sometimes contains data and other times it doesn't, and when it doesn't the column should be removed?

0 Karma

Path Finder

Correct. This is for a dashboard view that I will be turning over to users so I want to simplify the view if a column does not have data.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!