topic Re: How to return events with or without a value in a specific field? in Splunk Search

How to return events with or without a value in a specific field?

KyleMcDougall — Wed, 11 May 2022 15:08:06 GMT

Hi all!

I'm trying to create a table with case_number and session as the two columns.

Any event without a case_number won't show up in the table. How do I get them to show up?

index=cui botId=123456789 case_number=* session=* | table case_number session

I tried using | fields case_number instead, but this didn't work either.

Appreciate any help!

Re: How to return events with or without a value in a specific field?

batabay — Wed, 11 May 2022 15:18:03 GMT

Hi,

You can fill empty fields with fillnull command, try this ;

index=cui "your search" | fillnull case_number value=null | table case_number session

Re: How to return events with or without a value in a specific field?

KyleMcDougall — Wed, 11 May 2022 15:55:31 GMT

This is really good to know! But, I still wasn't able to get events without a case number to show up.

I think the case_number=* parameter is enforcing that a value is present for this field.

Re: How to return events with or without a value in a specific field?

somesoni2 — Wed, 11 May 2022 18:30:59 GMT

Your base search is looking for events where both case_number and session fields are available. To see everything, just remove that filter from base search, like this

index=cui botId=123456789 session=* | table case_number session

If you want to display some different value instead of blanks/null, try this version

index=cui botId=123456789 session=* | eval case_number=coalesce(case_number,"Not Available") | table case_number session

Re: How to return events with or without a value in a specific field?

KyleMcDougall — Wed, 11 May 2022 18:47:47 GMT

For some reason, the case number field doesn't show up unless I add in "case_number=*'

Dually noted your eval command. I'm sure I'll end up using it if I can figure out how to get the blank case number values to populate.

Re: How to return events with or without a value in a specific field?

TDFlames — Tue, 15 Nov 2022 15:20:26 GMT

Hi,

What you can try is

| fillnull value=

don't fill anything after the =

I'm having the same issue and this works for me, let me know if it works for you.