topic Re: Return value based on missing field in Splunk Search

Return value based on missing field

ialahdal — Wed, 30 Sep 2020 03:38:53 GMT

I want to make a search that will return a count of session_id based on the following fields
logged_out, logged_in
I want a count of how many sessions have an event with the logged_in field existing & the logged_out field not existing, this way I can tell exactly how many sessions are currently online.

How would I compare based on a field not existing, I tried isnull() and it didn't work as needed.

Re: Return value based on missing field

ialahdal — Wed, 30 Sep 2020 03:38:56 GMT

Something like if logged_in="yes" & nonexist(logged_out) return true
count true by session_id

Re: Return value based on missing field

kamlesh_vaghela — Mon, 13 Jan 2020 11:39:37 GMT

@ialahdal

Try:

YOUR_SEARCH | eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0)
| stats sum(flag)

Sample:

| makeresults 
| eval logged_in="Yes",logged_out="Yes" 
| append 
    [| makeresults 
    | eval logged_in="Yes"] 
| eval flag=if(logged_in=="Yes" AND isnull(logged_out),1,0)
| stats sum(flag)

Re: Return value based on missing field

Vijeta — Mon, 13 Jan 2020 17:32:24 GMT

@ialahdal You can do something like below.

<your search query> | stats count(eval(ISNOTNULL(logged_in))) as in_count , count(eval(ISNOTNULL(logged_out)) as out_count by SessionID| where in_count  > out_count

Re: Return value based on missing field

ialahdal — Tue, 14 Jan 2020 10:39:48 GMT

Thanks to you and @kamlesh_vaghela, I think isnull is making values null, using isnotnull like you mentioned did get me to the results I needed eventually.
Thanks.