Splunk Search

help to remove an empty line

jip31
Motivator

hI

I use the request below
sometimes I have only value for Free_Space and sometimes only value for TotalSpace instead both
I need a way to don't dispalay the result (in table) if one of these 2 fields is NULL
Could you help ME please??

(eventtype="TotalSpace" OR ( eventtype="DiskHealthSize" AND Value<15)) 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " GB" 
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
| sort +Free_Space limit=10

Thanks

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi @jip31

Try like

your query...
|search Value=* AND TotalSpace=*
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
 | sort +Free_Space limit=10

View solution in original post

0 Karma

Vijeta
Influencer

can you share your events ?

0 Karma

jip31
Motivator

Hi
Thanks but i am not sure that * is the better day? I try with fillnull but i dont succeed

0 Karma

vnravikumar
Champion

Or try with |where Value !="" AND TotalSpace !=""

0 Karma

vnravikumar
Champion

or |where isnotnull(Value ) AND isnotnull(TotalSpace )

0 Karma

jip31
Motivator

yes many thanks

0 Karma

vnravikumar
Champion

@jip31 have you tried?

0 Karma

vnravikumar
Champion

Hi @jip31

Try like

your query...
|search Value=* AND TotalSpace=*
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
 | sort +Free_Space limit=10
0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...