Exporting non empty columns from Worskspace

%3CLINGO-SUB%20id%3D%22lingo-sub-1095198%22%20slang%3D%22en-US%22%3EExporting%20non%20empty%20columns%20from%20Worskspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1095198%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Guys%2C%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20wanted%20to%20export%20only%20non%20empty%20columns%20via%20queries%20in%20work%20space.%20Could%20any%20one%20kindly%20provide%20the%20respective%20query%20for%20it.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFor%20eg%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESecurity%20Event%20%7C%20where%20AlertName%20contains%20%22DCSync%20Attack%22%26nbsp%3B%20--%20%26gt%3B%20I%20do%20not%20want%20columns%20with%20empty%20data.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1095458%22%20slang%3D%22en-US%22%3ERe%3A%20Exporting%20non%20empty%20columns%20from%20Worskspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1095458%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F503472%22%20target%3D%22_blank%22%3E%40kmanish%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20use%20the%20function%20isnotempty()%20by%20adding%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CDIV%3E%3CDIV%3E%3CSPAN%3E%7C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Ewhere%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Bisnotempty%3C%2FSPAN%3E%3CSPAN%3E(%22ColumnName%22%3C%2FSPAN%3E%3CSPAN%3E)%3C%2FSPAN%3E%3C%2FDIV%3E%3CDIV%3E%26nbsp%3B%3C%2FDIV%3E%3CDIV%3E%3CSPAN%3Eto%20your%20query%26nbsp%3B%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1096375%22%20slang%3D%22en-US%22%3ERe%3A%20Exporting%20non%20empty%20columns%20from%20Worskspace%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1096375%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20a%20lot.%20This%20is%20helpful.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20i%20can%20get%20all%20the%20columns%20which%20contains%20some%20data%2C%20without%20specifying%20the%20name%20of%20the%20column%20..%20for%20eg%2C%20i%20wanted%20all%20results%20in%20Common%20Security%20Log%20table..%20filtering%20out%20all%20the%20columns%20which%20dont%20have%20any%20data%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Eregards%3C%2FP%3E%3CP%3Emanish%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Contributor

Hi Guys, 

 

I wanted to export only non empty columns via queries in work space. Could any one kindly provide the respective query for it. 

 

For eg 

 

Security Event | where AlertName contains "DCSync Attack"  -- > I do not want columns with empty data. 

2 Replies
Highlighted

@kmanish 

 

You can use the function isnotempty() by adding

 

where isnotempty("ColumnName")
 
to your query 

Thanks a lot. This is helpful. 

 

Is there a way i can get all the columns which contains some data, without specifying the name of the column .. for eg, i wanted all results in Common Security Log table.. filtering out all the columns which dont have any data 

 

regards

manish