[splunk] null 값만 있는 필드 제거하기

https://community.splunk.com/t5/Splunk-Search/How-do-I-remove-a-null-field/m-p/141579

 

| foreach * 
    [ eval "<<FIELD>>" = if('<<FIELD>>' = 0, null(), '<<FIELD>>') ] 
| stats values(*) as * by _time