topic Re: To Exclude all the NULL values from the index in Getting Data In

To Exclude all the NULL values from the index

Raj — Fri, 29 Sep 2023 09:40:09 GMT

Hello,

I was trying to explore all the null values in my index but is it not working as expected do we need any changes in the search

index=vpn earliest=-7d
| fieldsummary
| where match(values, "^\[{\"value\":\"null\",\"count\":\d+\}\]$")

Thanks

Re: To Exclude all the NULL values from the index

gcusello — Fri, 29 Sep 2023 10:23:27 GMT

Hi @Raj,

could you better describe what you whould do?

if you already indexed a log, you canot remove an avent or a part of it.

If you want to exclude some null values from a search you can do iy in the search.

So what' your requirement?

Ciao.

Giuseppe

Re: To Exclude all the NULL values from the index

Raj — Fri, 29 Sep 2023 10:39:58 GMT

Hello,

I was trying to look for indexed null values and will decide to ingest after knowing them.

Re: To Exclude all the NULL values from the index

gcusello — Fri, 29 Sep 2023 11:03:09 GMT

Hi @Raj,

at first you have to analyze your data and see if you correctly parsed it, in other words, if you're using the correct Add-On.

At this point you should'n have NULL values in fields.

Ciao.

Giuseppe

Re: To Exclude all the NULL values from the index

Raj — Fri, 29 Sep 2023 11:27:53 GMT

Thanks ,
I can see the values of some fields in my index as null, what does it mean the data is ingesting or not ???

Re: To Exclude all the NULL values from the index

gcusello — Fri, 29 Sep 2023 12:20:31 GMT

Hi @Raj,

if you don't have any recognized field, this means that you have a parsing problem.

At first you have to check if you instaled the correct Add-On and if you associated the correct sourcetype with yur data flow.

Then you have to analyze your data, see the sourcetype associated with these events and see what's the issue,

Ciao.

Giuseppe