topic Re: how to remove null entries from search results in Splunk Search

How to remove null entries from search results?

Aj01 — Thu, 29 Dec 2022 03:24:10 GMT

i have been using this query but couldn't be able to remove null rows, please help me

index=Window_wash | rex field=_raw "TIME.TAKEN.FOR.(?<Vendor>\w+)" | rex field=_raw (?<Time_MS>\d+).ms | timechart span=1m max(Time_MS) as Time_MS | outlier Time_MS

Re: how to remove null entries from search results

gcusello — Sun, 25 Dec 2022 09:21:33 GMT

Hi @Aj01,

did you tried with the where command?

Ciao.

Giuseppe

Re: how to remove null entries from search results

Aj01 — Sun, 25 Dec 2022 09:39:38 GMT

Hi @gcusello

Thanks for helping, it worked i was using where Time_MS=* or Time_MS!=null but this worked

Thankyou

Re: how to remove null entries from search results

gcusello — Mon, 26 Dec 2022 07:34:42 GMT

Hi @Aj01,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: how to remove null entries from search results

pstout2 — Mon, 26 Dec 2022 14:08:17 GMT

Remember, search is used to compare fields to literals whereas where is used to compare fields to fields or expressions.

Sometimes both work. Sometimes not.

| search Time_MS>0

| where isnotnull(Time_MS)