https://community.splunk.com/t5/Splunk-Search/Filtering-out-NULL-values-after-stats-not-working/m-p/571530#M199156 <P>I am trying to filter out null values from the result of stats. Query looks like below.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index=someindex* some ((somefield1=value1 AND somefield2="value2") AND (somefield1=value3 OR (somefield2=value4 AND somefield1=value5 ) ) ) OR (somefield1=value6) | eval someeval=... | replace "some*" with "SOME" in somefield1 | bucket _time span=1d as daytime | stats max(eval(if(somefield1=value1,_time,null()))) as val1_time min(eval(if(somefield1=value2,_time,null()))) as val2_time min(eval(if(somefield1=value3 ,_time,null()))) as val3_time by somefield3 somefield4 | eval recovered_time=if(isNotNull(val2_time),val2_time,val3_time) | where isNotNull(val1_time)</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>But this query returns result with null or empty val1_time also.<BR /><BR />What could be the issue in this query? I further pass the result of this query to another stats query.&nbsp; But I am stuck here.</P> Tue, 19 Oct 2021 15:56:17 GMT tumapath 2021-10-19T15:56:17Z https://community.splunk.com/t5/Splunk-Search/Filtering-out-NULL-values-after-stats-not-working/m-p/571530#M199156 <P>I am trying to filter out null values from the result of stats. Query looks like below.</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index=someindex* some ((somefield1=value1 AND somefield2="value2") AND (somefield1=value3 OR (somefield2=value4 AND somefield1=value5 ) ) ) OR (somefield1=value6) | eval someeval=... | replace "some*" with "SOME" in somefield1 | bucket _time span=1d as daytime | stats max(eval(if(somefield1=value1,_time,null()))) as val1_time min(eval(if(somefield1=value2,_time,null()))) as val2_time min(eval(if(somefield1=value3 ,_time,null()))) as val3_time by somefield3 somefield4 | eval recovered_time=if(isNotNull(val2_time),val2_time,val3_time) | where isNotNull(val1_time)</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>But this query returns result with null or empty val1_time also.<BR /><BR />What could be the issue in this query? I further pass the result of this query to another stats query.&nbsp; But I am stuck here.</P> Tue, 19 Oct 2021 15:56:17 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-out-NULL-values-after-stats-not-working/m-p/571530#M199156 tumapath 2021-10-19T15:56:17Z https://community.splunk.com/t5/Splunk-Search/Filtering-out-NULL-values-after-stats-not-working/m-p/571755#M199239 <P>Adding this line in the end does the magic.&nbsp;</P><LI-CODE lang="markup">| where isNotNull(val1_time) AND val1_time != ""</LI-CODE><P>&nbsp;</P> Thu, 21 Oct 2021 04:17:07 GMT https://community.splunk.com/t5/Splunk-Search/Filtering-out-NULL-values-after-stats-not-working/m-p/571755#M199239 tumapath 2021-10-21T04:17:07Z