topic Re: Exclude Null in subsearch in Splunk Search

Exclude Null in subsearch

rajkskumar — Wed, 30 Sep 2020 11:08:47 GMT

I have the following query used to build a chart. Sometimes, the incoming events do not have the fields set. How could these events with null could be excluded in a Subsearch?

index=prod | search processRelevantFields.processName="SessionExecution"|search prod.customerId=* prod.productId=* | timechart dc(customer.ciamId) as "Active Users"

I have tried with "search <fieldName> =*" as given above. But this is not working. Please guide on how this could be implemented?

Re: Exclude Null in subsearch

ITWhisperer — Wed, 30 Sep 2020 11:33:45 GMT

In what way is it not working?

Have you tried including the filters on the main search?

index=prod processRelevantFields.processName="SessionExecution" prod.customerId=* prod.productId=* | timechart dc(customer.ciamId) as "Active Users"

Re: Exclude Null in subsearch

rajkskumar — Wed, 30 Sep 2020 12:18:08 GMT

The Main search is a complex base search query. The Subsearch is used to filter out the elements for this specific chart.

The result includes events which has null fields

Re: Exclude Null in subsearch

ITWhisperer — Wed, 30 Sep 2020 12:50:28 GMT

OK try putting the field names containing dots in single quotes

index=prod | search 'processRelevantFields.processName'="SessionExecution"|search 'prod.customerId'=* 'prod.productId'=* | timechart dc(customer.ciamId) as "Active Users"

Re: Exclude Null in subsearch

isoutamo — Wed, 30 Sep 2020 16:12:27 GMT

Hi
even this is old post it describes when to use search and when to use where and what are differences between those.
https://community.splunk.com/t5/Splunk-Search/Help-understanding-the-commands-Search-vs-Where-after-first-pipe/m-p/205626
There are quite many other posts about the same thing. I propose that you will read those and look if those helps you.
r. Ismo