topic Re: Writing a regular expression to capture null values in Splunk Search https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361346#M164033 <P>Do you want to find events like:</P> <P><CODE>fieldyoucareabout= otherfield1=value1 otherfield2=value2</CODE></P> <P>Or instead:</P> <P><CODE>otherfield1=value1 otherfield2=value2</CODE></P> Wed, 03 Jan 2018 19:09:02 GMT micahkemp 2018-01-03T19:09:02Z Writing a regular expression to capture null values https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361343#M164030 <P>Hi,</P> <P>I've got fields which contain null values. I'm writing a regular expression to capture instances where fields contain null values. </P> <P>This is what I have, but it's not working. <BR /> ^(^.){0}$<BR /> I'm trying to say in this expression, looking something that's empty. But as mentioned before, it's not working. I'm not too sure how null works in splunk.</P> <P>Could someone please help me with this?</P> <P>Thanks<BR /> Mahbs</P> Wed, 03 Jan 2018 16:14:42 GMT https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361343#M164030 mahbs 2018-01-03T16:14:42Z Re: Writing a regular expression to capture null values https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361344#M164031 <P>@mahbs, can you add sample events and also your current code using the code button <CODE>(101010)</CODE> on Splunk Answers, so that special characters do not escape?</P> Wed, 03 Jan 2018 16:25:13 GMT https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361344#M164031 niketn 2018-01-03T16:25:13Z Re: Writing a regular expression to capture null values https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361345#M164032 <P>Have you tried using <CODE>your base search | where isnull(fieldname)</CODE> syntax rather than regular expressions? You can use this to find events with null values for any number of fields by chaining them like this: <CODE>your base search | where isnull(fieldname) OR isnull(field2name)...</CODE></P> Wed, 03 Jan 2018 18:53:52 GMT https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361345#M164032 elliotproebstel 2018-01-03T18:53:52Z Re: Writing a regular expression to capture null values https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361346#M164033 <P>Do you want to find events like:</P> <P><CODE>fieldyoucareabout= otherfield1=value1 otherfield2=value2</CODE></P> <P>Or instead:</P> <P><CODE>otherfield1=value1 otherfield2=value2</CODE></P> Wed, 03 Jan 2018 19:09:02 GMT https://community.splunk.com/t5/Splunk-Search/Writing-a-regular-expression-to-capture-null-values/m-p/361346#M164033 micahkemp 2018-01-03T19:09:02Z