https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483381#M135339 <P>You are on the correct path, you should avoid using empty sets in any fields unless some very specific use cases. Your evals should be this <CODE>EVAL-sensor_01 = if(valueName="raw_sensor_01", value, null())</CODE> The <CODE>null()</CODE> command makes it a null value instead of an empty set.</P> Wed, 15 Jan 2020 19:46:14 GMT dmarling 2020-01-15T19:46:14Z https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483379#M135337 <P>Hi,</P> <P>I'm having trouble retrieving my fields from an accelerated data model.<BR /> The main problem is that most of the fields are optional...<BR /> lets say the corresponding sourcetype looks like this:</P> <UL> <LI>asset_type (required)</LI> <LI>asset_id (required)</LI> <LI>sensor_01 (optional)</LI> <LI>sensor_02 (optional)</LI> </UL> <P>then two events could look like this:</P> <P><STRONG>asset_type / asset_id / sensor_01 / sensor_02</STRONG> <BR /> "123" / "007" / "12.75" / ""<BR /> "123" / "007" / "" / "1265.99"</P> <P>Now, when i search via the tstats command like this:</P> <PRE><CODE>| tstats summariesonly=t latest(dm_main.sensor_01) latest(dm_main.sensor_02) FROM datamodel=dm_main by dm_main.asset_type dm_main.asset_id | rename dm_main.* AS * </CODE></PRE> <P>I only get either a value for sensor_01 OR sensor_02, since the latest value for the other is a blank...<BR /> I tried reaching around that by using list(), but its not available for tstats.<BR /> Then I tried using values(), which gives me the values I need, but in alphabetically order. But I need to know the lastest.</P> <P>Is there a way with tstats to search for LATEST NOT NULL?</P> <P>additional info:</P> <P>the fields in Question are not native to the sourcetype, they are calculated fields:</P> <PRE><CODE>EVAL-sensor_01 = if(valueName="raw_sensor_01", value, "") EVAL-sensor_02 = if(valueName="raw_sensor_02", value, "") </CODE></PRE> Wed, 30 Sep 2020 03:39:49 GMT https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483379#M135337 hbrandt84 2020-09-30T03:39:49Z https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483380#M135338 <P>Okay, It seems like I need to change:<BR /> EVAL-sensor_01 = if(valueName="raw_sensor_01", value, <STRONG>""</STRONG>)</P> <P>to:<BR /> EVAL-sensor_01 = if(valueName="raw_sensor_01", value, <STRONG>NULL</STRONG>)</P> Wed, 30 Sep 2020 03:39:54 GMT https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483380#M135338 hbrandt84 2020-09-30T03:39:54Z https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483381#M135339 <P>You are on the correct path, you should avoid using empty sets in any fields unless some very specific use cases. Your evals should be this <CODE>EVAL-sensor_01 = if(valueName="raw_sensor_01", value, null())</CODE> The <CODE>null()</CODE> command makes it a null value instead of an empty set.</P> Wed, 15 Jan 2020 19:46:14 GMT https://community.splunk.com/t5/Splunk-Search/Data-Model-TStats-time-functions-get-latest-NOT-NULL/m-p/483381#M135339 dmarling 2020-01-15T19:46:14Z