Activity Feed
- Karma Re: How do I Exclude null/empty fields from a lookup result where I should get a single row back for PickleRick. 01-22-2025 06:55 AM
- Posted Re: How do I Exclude null/empty fields from a lookup result where I should get a single row back on Splunk Search. 01-22-2025 06:14 AM
- Posted How do I Exclude null/empty fields from a lookup result where I should get a single row back on Splunk Search. 01-21-2025 01:22 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
01-22-2025
06:14 AM
Hi - thanks for the idea, Sure, I could build that into the search, true. On the output dashboard what you end up with is "1 2 3 next..." on the bottom right, so you need to click through to see all possible values from the lookup that we have on hand. Often enugh there are 4-6 rows of empty fields in the result set, because the data is transpose'd. I'm looking to make the returned data more compact, if you will.
... View more
01-21-2025
01:22 PM
We have a lookup that has all kinds of domain (DNS) information in it with about 60 fields like create date, ASN, name server IP, MX IP, many of which are usually populated. But there are several fields which have no data - 10 to 20 on any given search (assuming that they are 'null'). The empty fields are likely to vary on each search. In other words some domains will have an MX record, some will not, but if they are in this lookup, they will always have a create-date. I am presenting this data on a domain lookup dashboard, using "|transpose" so that you have a table with the field name and value on a dashboard. I would like to just show a field and a value where this is returned data and filter out or not show a field which is null. Is there a way to do this?
... View more
Labels
- Labels:
-
lookup
