Splunk Search

For a Table, display only fields/columns that are NULL AND have them displayed in an order

tdiestel
Path Finder

Hi All;

I want my table to display only fields that have values for at least 1 row AND have the fields be in the order that I specify. Splunk always puts the fields in Alphabetical Order, which is not what I want. For example, here's my code:

...| chart count over global_stand_name by global_order_status_display

This gives me what i want by not including NULL values, but the ordering of the fields is off. Thus I do this:

| table Stand Created Bumped Assigned Completed

which gives me my data in the correct order but it then displays fields that might have no values in it. Thus my table will look like this:
Stand, Created, Bumped, Assigned, Completed
stand1, 5, , , 10
stand2, 6, , 12, 11
stand3, 7, , 2, 23

In this case there are no values for Bumped, so I'd like the field Bumped to not be displayed, but still have the order be Stand, Created, Assigned, Completed

Is this possible?

Thanks,
Tyler

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can trick table like this:

... | table Stand* Created* Bumped* Assigned* Completed*

By adding the wildcard you're not actually changing the meaning in your context, but you're taking away table's urge to create an empty column.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can trick table like this:

... | table Stand* Created* Bumped* Assigned* Completed*

By adding the wildcard you're not actually changing the meaning in your context, but you're taking away table's urge to create an empty column.

tdiestel
Path Finder

This worked like a charm. Thank you Martin! I would have and have been beating my head in on this one.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...