CODEWITHSUNDEEP
splunksplunk-querysplunk-dashboardsplunk-formula
Anand Somani
Anand Somani

Reputation: 801

How to remove empty rows from Splunk table?

In my query response, few time I don't get data and it's just adding row empty row. I like to remove empty row it's my regex not found any records.

index=stg host="stg-host1" " Number of data processed for day is"
| rex "(?<Records>[^\s]+) from file"
| timechart max(Records) as TotalRecords 
span=45min

Expected: Remove all empty rows. Row should only available if TotalRecords has some value.

Current Table: enter image description here

Upvotes: 0

Views: 4495

Answers (1)

Tom
Tom

Reputation: 665

You can use the following command to remove results that contain a specific field with a null value, in this case TotalRecords:

| where isnotnull(TotalRecords)

Upvotes: 2

Related Questions