Splunk Search

help to remove an empty line

jip31
Motivator

hI

I use the request below
sometimes I have only value for Free_Space and sometimes only value for TotalSpace instead both
I need a way to don't dispalay the result (in table) if one of these 2 fields is NULL
Could you help ME please??

(eventtype="TotalSpace" OR ( eventtype="DiskHealthSize" AND Value<15)) 
| eval time = strftime(_time, "%m/%d/%Y %H:%M") 
| eval Value = round(Value, 1). " %" 
| eval TotalSpace = TotalSpaceKB/1024 
| eval TotalSpace = round(TotalSpace/1024,1). " GB" 
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
| sort +Free_Space limit=10

Thanks

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi @jip31

Try like

your query...
|search Value=* AND TotalSpace=*
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
 | sort +Free_Space limit=10

View solution in original post

0 Karma

Vijeta
Influencer

can you share your events ?

0 Karma

jip31
Motivator

Hi
Thanks but i am not sure that * is the better day? I try with fillnull but i dont succeed

0 Karma

vnravikumar
Champion

Or try with |where Value !="" AND TotalSpace !=""

0 Karma

vnravikumar
Champion

or |where isnotnull(Value ) AND isnotnull(TotalSpace )

0 Karma

jip31
Motivator

yes many thanks

0 Karma

vnravikumar
Champion

@jip31 have you tried?

0 Karma

vnravikumar
Champion

Hi @jip31

Try like

your query...
|search Value=* AND TotalSpace=*
| stats latest(Value) as Free_Space latest(TotalSpace) as TotalSpace by host 
 | sort +Free_Space limit=10
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...