Splunk Search

empty fields in a table

gagareg
Explorer

why does Splunk display empty fields in the table even though there are values there

alt text

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Cells in a table tend to be empty because either 1) the field has no value in the event; or 2) the event has no field by that name.
Run the search in Verbose Mode then look in the Events tab to see if the fields are indeed present and have values. Pay close attention to the spelling and capitalization of field names as Splunk cares about both. "status" is not the same as "Status", for example.

Pro tip: Add a default clause to your case functions to catch unexpected values. Something like eval description = case(status==200, "OK", ..., 1==1, "unknown").

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Cells in a table tend to be empty because either 1) the field has no value in the event; or 2) the event has no field by that name.
Run the search in Verbose Mode then look in the Events tab to see if the fields are indeed present and have values. Pay close attention to the spelling and capitalization of field names as Splunk cares about both. "status" is not the same as "Status", for example.

Pro tip: Add a default clause to your case functions to catch unexpected values. Something like eval description = case(status==200, "OK", ..., 1==1, "unknown").

---
If this reply helps you, Karma would be appreciated.

fgarvis0_36
New Member

I'm also having this problem, already in verbose mode but I had to go into "XX more fields" to add these to my initial query.  Am I better off attempting this as a dashboard or getting those fields automatically added to the search?  @richgalloway 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're having a similar problem, but this solution doesn't help then you have a different problem and should post a new question.

---
If this reply helps you, Karma would be appreciated.
0 Karma

gagareg
Explorer

Yes, you're right about mode. I tried Verbose mode, and it works as expected. Thank you

0 Karma

gagareg
Explorer

But I face another issue: I have following a splunk query

source="maillog.log" host="mail_server" sourcetype="mail" | rex "(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"

When I use top command

source="maillog.log" host="mail_server" sourcetype="mail" | rex "(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | top ip

it shows well. But when using table command it shows again field with null.

source="maillog.log" host="mail_server" sourcetype="mail" | rex "(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | table _time ip

I use Verbose mode and there are values in ip field.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...