Filtering NULL values after STATS

gmartinv — Wed, 30 Sep 2020 05:27:37 GMT

Hello Splunkers,

First of all, than you all for such great community.

I have a question. I am running a query in which I am using appendcols to append the results of a subsearch to my initial search. I am doing this because I am managing large datasets and I want to avoid using the JOIN command. My query is the following one:

index=active_directory (source="ACTIVE_DIRECTORY")
| dedup NUUMA
| eval NUUMA=tostring(upper(NUUMA))
| table NUUMA DISPLAYNAME UserAcControl

| stats values(UserAcControl) count by NUUMA

I am getting the results that I need, but after the STATS command, I need to select the UserAcControl attribute with NULL values. I have tried doing something like this, but it is not working:

…| stats values(UserAcControl) count by NUUMA | where isnull(UserAcControl)

I am attaching a screenshot showing the the values that I want to capture.

Any thoughts??

Thank you!!

Re: Filtering NULL values after STATS

to4kawa — Sun, 17 May 2020 22:57:20 GMT

NULL is nothing, not "NULL" string.

| stats values(UserAcControl) count by NUUMA | where isnull(UserAcControl)
→ | stats values(UserAcControl) as UserAcControl count by NUUMA | where UserAcControl="NULL"

Re: Filtering NULL values after STATS

gmartinv — Sun, 17 May 2020 23:15:30 GMT

Thank you!!

topic Filtering NULL values after STATS in Getting Data In

Filtering NULL values after STATS

Re: Filtering NULL values after STATS

Re: Filtering NULL values after STATS