When running a search like "blablabla | table *", is there a way to determine empty fields and only table fields with values?

[stephane_cyrill]

When using a search like this: blablabla | table * is there a way to determine empty fields and remove them so that the table displays only fields with values? i just want to know in advance which field is empty and remove it from the result.

[jeffland · Accepted solution]

You can always remove empty fields by hand:
bla | table * | fields -emptyField

Are your fields only sometimes missing in individual results, or are some fields always empty? If the latter is the case, it would be interesting to see why they are there and you might want to prevent them from appearing in the first place (maybe you have an unneccessary eval somewhere or something like that). If the former is the case, I don't understand how you want to "remove" that field - if you remove it entirely (e.g. with fields - emptyField), you won't be able to see this field in other events which do have values there.

You can find empty fields with a search like this:
NOT emptyField=*
This will give you all results where emptyField is empty. For further reading, see http://answers.splunk.com/answers/25445/splunk-search-language.html

Hope I could help you a little.

[pradeepkumarg]

fillnull might be an option for you.. | fillnull value=NA
This will fill all the empty fields with NA and then if you wish, you can add another search term to ignore all the rows where a specific field has NA

| fillbull value=NA | search myField!="NA"