https://community.splunk.com/t5/Splunk-Search/Counting-values/m-p/29128#M177894 <P>Hi,<BR /> i have a key value pair say FTYPE=VAL1 and FTYPE=VAL2 and create a timechart with</P> <P>earliest=-1d@d latest=now | timechart <BR /> count(eval(FTYPE=VAL1)) as TYPE1, count(eval(FTYPE="VAL2")) as TYPE2</P> <P>All for sudden i notice that the expected numbers are wrong because some of the FTYPE values are blank like FTYPE= </P> <P>How can i create the timechart where blank FTYPE values are treated as VAL1? I tried something like <BR /> count(eval(FTYPE=VAL1 OR FTYPE="")) as TYPE1</P> <P>somehow that doesn't work either.</P> <P>Any ideas? Many thanks ...</P> Tue, 12 Feb 2013 18:05:36 GMT mkrauss1 2013-02-12T18:05:36Z https://community.splunk.com/t5/Splunk-Search/Counting-values/m-p/29128#M177894 <P>Hi,<BR /> i have a key value pair say FTYPE=VAL1 and FTYPE=VAL2 and create a timechart with</P> <P>earliest=-1d@d latest=now | timechart <BR /> count(eval(FTYPE=VAL1)) as TYPE1, count(eval(FTYPE="VAL2")) as TYPE2</P> <P>All for sudden i notice that the expected numbers are wrong because some of the FTYPE values are blank like FTYPE= </P> <P>How can i create the timechart where blank FTYPE values are treated as VAL1? I tried something like <BR /> count(eval(FTYPE=VAL1 OR FTYPE="")) as TYPE1</P> <P>somehow that doesn't work either.</P> <P>Any ideas? Many thanks ...</P> Tue, 12 Feb 2013 18:05:36 GMT https://community.splunk.com/t5/Splunk-Search/Counting-values/m-p/29128#M177894 mkrauss1 2013-02-12T18:05:36Z https://community.splunk.com/t5/Splunk-Search/Counting-values/m-p/29129#M177895 <P>You test for null like this : isnull(field)<BR /> So your search would be :</P> <P>FTYPE=VAL1 OR isnull(FTYPE)</P> <P>or, you could jsut do this beforehand :</P> <PRE><CODE>... | eval FTYPE=if(isnull(FTYPE),"VAL1",FTYPE) | ... </CODE></PRE> Tue, 12 Feb 2013 18:31:15 GMT https://community.splunk.com/t5/Splunk-Search/Counting-values/m-p/29129#M177895 jonuwz 2013-02-12T18:31:15Z