You forgot to embed the macro into the ` ` characters. Like this: `auth(src)` PS: Yes, I know this is a really delayed answer and the problem most likely has already been solved. Just a help for users having with a similar issue. ... View more

@samcogheil - Thanks a lot for the update! Could you turn your comment into a separate answer so that we can upvote it as the new right answer to the original question? That way others will find your solution faster! 🙂 ... View more

Thanks for this additional investigation hint. Helped a lot in my case. ... View more

This should be a comment to the mentioned answer rather than another 'answer'. Very misleading as the order of answers changes. ... View more

I have the same issue here. And I cannot access the transforms.conf file (or the server's file system at all) to get the Stanza of my field extractor. In the Splunk Web-UI in the field extractions overview, the name of my field extractor is like my_sourcetype : EXTRACT-my_new_field. Is there any other way to derive the Stanza through the Splunk Web-UI? ... View more

What about adding... | stats first(*) as * by OBJECT ...at the end of your search pipe? Limitation: This lightweight approach only works if every other column contains max. one unique value per OBJECT. Otherwise stick with the values() variant suggested by @srujan9292. ... View more

Didn't work in my case - The empty columns persisted (Splunk 7.0.2). Instead, I found this solution Link here in the forum: https://answers.splunk.com/answering/593190/view.html ... View more

Appending the transpose command two times will help you out. I am referring to this answer in a similar thread: https://answers.splunk.com/answers/241186/removing-null-columns-from-a-table.html#answer-593190 Simply add: | transpose 0 | transpose 0 header_field=column | fields - column // Some further notes: - Why it works: When transposing a table, Splunk automatically removes every resulting empty row (= previously empty column). - The 0 option makes sure that every row and every column gets transposed. - The only downside: The transpose command is pretty time-consuming. Use it carefully. - For further info in Splunk Doku: https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transpose ... View more

Awesome answer - simple and works very well! Should be accepted as the right answer imho. The only downside to consider: The transpose commands demand a lot of computing power = time. ... View more