Splunk Search

Show only non-zero fields

ericchaucl
Path Finder

Hi,

How can I run a search and only display those columns with non-zero values? For example, I have fields test1, test2, test3, .... test99, in which only test2 and test10 are non-zero. Would be perfect if there is something like this:
| fields test* | where test* > 0

P.S. To be more specific, this scenario happens when I create and apply a TFIDF model. The system automatically generate a huge # of fields with suffix _tfidf. I would like to run some query and is interested in those non-zero fields only.

Tags (1)
0 Karma
1 Solution

3no
Communicator

Hey,

| table test* | transpose | rename column as Test "row 1" as count | where count > 0

3no.

View solution in original post

0 Karma

3no
Communicator

Hey,

| table test* | transpose | rename column as Test "row 1" as count | where count > 0

3no.

0 Karma

ericchaucl
Path Finder

It works! Million thanks!

0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...