How to search partial field names and exclude events that contain no value

ganon640 — Wed, 26 Jun 2019 14:52:42 GMT

Hi,
I want my search to only return events that have field names matching Feature.Flags*
My data currently has the below field names but more and more feature flags will be released over time so I don't want to hard code them into the search.

Feature.Flags.1
Feature.Flags.2
Feature.Flags.3

How can I construct a search to only return events that contain any of these Feature.Flags* Field names but to exclude any events when all matching Feature.Flags fields have no value?

e.g. Only return Event 1 and 3 below
Event 1
Feature.Flags.1 = True
Feature.Flags.2 = ""
Feature.Flags.3 = False

Event 2 (All Fields have no value so exclude this from the search)
Feature.Flags.1 = ""
Feature.Flags.2 = ""
Feature.Flags.3 = ""

Event 3
Feature.Flags.1 = False
Feature.Flags.2 = False
Feature.Flags.3 = False

I've tried different things but can't get it to work. For example the below returns all events in a table but unfortunately it includes Events where all Feature.Flags* fields have empty values

table host Feature.Flags*

I also tried the below but it just returned all entries with HostFlags set to False and none set to True

eval HostFlags="" | foreach "Feature.Flags"* [eval HostFlags='<<FIELD>>'] | search HostFlags=*
| table host Feature.Flags*

Re: How to search partial field names and exclude events that contain no value

amitm05 — Wed, 26 Jun 2019 19:42:47 GMT

ganon640

Try this -

| makeresults | eval  Feature.Flags.1 = "True", Feature.Flags.2 = "abc", Feature.Flags.3 = "xyz" | eval HostFlags="" | foreach "Feature.Flags"* [eval HostFlags='<<FIELD>>'] | where HostFlags!="" | table Feature.Flags*

And

| makeresults | eval  Feature.Flags.1 = "True", Feature.Flags.2 = "abc", Feature.Flags.3 = "" | eval HostFlags="" | foreach "Feature.Flags"* [eval HostFlags='<<FIELD>>'] | where HostFlags!="" | table Feature.Flags*

The first one will give you result and the second one will not. Which is what your criteria is.
Let me know. Thanks

topic How to search partial field names and exclude events that contain no value in Splunk Search

How to search partial field names and exclude events that contain no value

Re: How to search partial field names and exclude events that contain no value