<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to detect an empty field ? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641743#M109422</link>
    <description>&lt;P&gt;I have the field called Error and if there is error we get&amp;nbsp; error message if there is no error it will be empty&lt;BR /&gt;eg: Value for Error is &lt;STRONG&gt;E00000 duplicate key error&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;i have tried as below to add status if error thrown it is Failure else Success&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Status=case(len(Error)=='', "Success",len(Error)&amp;gt;0, "Failure")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It doesnt print Success&amp;nbsp; in Status where there is not error (Error is empty) Message&lt;/P&gt;&lt;P&gt;i tried below:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;it prints Success and Failure for Failure state&lt;/P&gt;&lt;P&gt;seems isnull satisfied for both the conditions. Please advise.&lt;/P&gt;</description>
    <pubDate>Fri, 28 Apr 2023 12:49:45 GMT</pubDate>
    <dc:creator>Jasmine</dc:creator>
    <dc:date>2023-04-28T12:49:45Z</dc:date>
    <item>
      <title>How to detect an empty field ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641743#M109422</link>
      <description>&lt;P&gt;I have the field called Error and if there is error we get&amp;nbsp; error message if there is no error it will be empty&lt;BR /&gt;eg: Value for Error is &lt;STRONG&gt;E00000 duplicate key error&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;i have tried as below to add status if error thrown it is Failure else Success&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Status=case(len(Error)=='', "Success",len(Error)&amp;gt;0, "Failure")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;It doesnt print Success&amp;nbsp; in Status where there is not error (Error is empty) Message&lt;/P&gt;&lt;P&gt;i tried below:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;BR /&gt;it prints Success and Failure for Failure state&lt;/P&gt;&lt;P&gt;seems isnull satisfied for both the conditions. Please advise.&lt;/P&gt;</description>
      <pubDate>Fri, 28 Apr 2023 12:49:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641743#M109422</guid>
      <dc:creator>Jasmine</dc:creator>
      <dc:date>2023-04-28T12:49:45Z</dc:date>
    </item>
    <item>
      <title>Re: How to detect an empty field ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641763#M109424</link>
      <description>&lt;P&gt;Can you please share example (sanitized) events, both success and failure?&amp;nbsp; It may help us to see the full query, also.&lt;/P&gt;</description>
      <pubDate>Fri, 28 Apr 2023 13:57:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641763#M109424</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2023-04-28T13:57:52Z</dc:date>
    </item>
    <item>
      <title>Re: How to detect an empty field ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641764#M109425</link>
      <description>&lt;P&gt;"{\"ID\": \"123\", \"Testing\": \"5\"}"&lt;BR /&gt;"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"&lt;/P&gt;&lt;P&gt;Please find sample data below:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;First data, it should return Failure

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"

Second data, it should return Success as not error here

"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;i tried as below, but not working&lt;/P&gt;&lt;P&gt;| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")&lt;/P&gt;&lt;P&gt;| eval Status=case(len(Error)&amp;lt;0, "Success",len(Error)&amp;gt;0, "Failure")&lt;/P&gt;</description>
      <pubDate>Fri, 28 Apr 2023 14:21:04 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641764#M109425</guid>
      <dc:creator>Jasmine</dc:creator>
      <dc:date>2023-04-28T14:21:04Z</dc:date>
    </item>
    <item>
      <title>Re: How to detect an empty field ?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641785#M109432</link>
      <description>&lt;P&gt;The evals use the Error field, but have you confirmed the field exists?&amp;nbsp; Please show the SPL prior to the &lt;FONT face="courier new,courier"&gt;eval&lt;/FONT&gt;.&lt;/P&gt;</description>
      <pubDate>Fri, 28 Apr 2023 17:24:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-detect-an-empty-field/m-p/641785#M109432</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2023-04-28T17:24:41Z</dc:date>
    </item>
  </channel>
</rss>

