topic Re: How to count total empty object? in Splunk Search

How to count total empty object?

alakdam — Wed, 05 Oct 2022 13:32:00 GMT

I have a data where I got empty object. I would like count in total how many empty object in one table data and also make average on this empty object.

PS: I am beginner level splunker and could not able to figure How Can I do average of empty object?

This was my failed attempt:

index::service sourcetype::service "order_tote_analytics" | spath "data.order_number" | search "data.order_number"=* | spath path=data{}.actual_totes output=finalBox | eval countNull=if(finalBox == "{}", "this has value", "this is all null") | table finalBox countNull

Above search query return me this 👇🏾👇🏾

Re: How to count total empty object

gcusello — Wed, 05 Oct 2022 12:58:46 GMT

Hi @alakdam,

please try something like this:

Ciao.

Giuseppe

Re: How to count total empty object?

alakdam — Wed, 05 Oct 2022 14:47:42 GMT

Thank you very much. How can I make average of it

Re: How to count total empty object?

gcusello — Wed, 05 Oct 2022 15:07:21 GMT

Hi @alakdam,

in this case you have to add the count all the events, something like this:

Ciao.

Giuseppe

Re: How to count total empty object?

alakdam — Wed, 05 Oct 2022 15:31:21 GMT

@gcusello Thank you very much. I would love to publish that average value in one single panel. How would I do that. I did like this 👇🏾👇🏾 but it does not show me average anymore 😔😔

<panel> <single> <title>Average Actual Boxes with an empty value</title> <search> <query>index::service sourcetype::service "order_tote_analytics" | spath "data.order_number" | search "data.order_number"=$orderNumber$ | spath path=data{}.actual_totes output=RealData | eval countNull=if(RealData == "{}", "this has value", "this is all null") | eventstats count AS total | search RealData="{}" | stats count values(total) AS total | eval average=count/total*100</query> <earliest>$chosenTimePeriod.earliest$</earliest> <latest>$chosenTimePeriod.latest$</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x53a051","0x53a051"]</option> <option name="rangeValues">[0,200]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel>

Re: How to count total empty object?

gcusello — Wed, 05 Oct 2022 15:39:30 GMT

Hi @alakdam,

add

| table average

as last row of your search

Ciao.

Giuseppe

Re: How to count total empty object?

alakdam — Wed, 05 Oct 2022 15:44:25 GMT

Did not help 😔😔😔. Could please copy my panel example and show to me? Also I don't think we need condition. what do you say?

Re: How to count total empty object?

gcusello — Thu, 06 Oct 2022 06:37:50 GMT

Hi @alakdam,

please try this:

<panel> <single> <title>Average Actual Boxes with an empty value</title> <search> <query>index::service sourcetype::service "order_tote_analytics" | spath "data.order_number" | search "data.order_number"=$orderNumber$ | spath path=data{}.actual_totes output=RealData | eval countNull=if(RealData == "{}", "this has value", "this is all null") | eventstats count AS total | search RealData="{}" | stats count values(total) AS total | eval average=count/total*100 | table average</query> <earliest>$chosenTimePeriod.earliest$</earliest> <latest>$chosenTimePeriod.latest$</latest> </search> <option name="colorMode">block</option> <option name="drilldown">none</option> <option name="rangeColors">["0x53a051","0x53a051","0x53a051"]</option> <option name="rangeValues">[0,200]</option> <option name="refresh.display">progressbar</option> <option name="useColors">1</option> </single> </panel>

Ciao.

Giuseppe

Re: How to count total empty object?

alakdam — Thu, 06 Oct 2022 06:45:34 GMT

You are legend. As it said in your profile. Thanks a bunch

Re: How to count total empty object?

gcusello — Thu, 06 Oct 2022 06:47:40 GMT

Hi @alakdam,

I didn't give the definition, but anywaythanks for the compliment!

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: How to count total empty object?

alakdam — Thu, 06 Oct 2022 06:53:25 GMT

I know I am asking a lot. Can you please help me with this Problem? I still don't understand splunk docs

Thank you 🙏🏾