topic Re: Finding the number of null cells in a table in Splunk Search

Finding the number of null cells in a table

P3G4SUS — Wed, 04 Oct 2023 07:38:32 GMT

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

ITWhisperer — Wed, 04 Oct 2023 07:49:12 GMT

You can't, addcoltotals doesn't work like that.

VatsalJagani — Wed, 04 Oct 2023 11:22:21 GMT

@P3G4SUS - You can do that like this:

.... | eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0) | stats sum(empty_cells) as total_empty_cells

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

I hope this helps!!!