topic Re: How to exclude null values in mv fields? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684256#M233585 <LI-CODE lang="markup">| where ErrorType != ""</LI-CODE> Mon, 15 Apr 2024 14:48:54 GMT ITWhisperer 2024-04-15T14:48:54Z How to exclude null values in mv fields? https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684240#M233572 <P>In my mv field nameas&nbsp; errortype.In the error type the counts shows <STRONG>file not found</STRONG> as 4 and <STRONG>empty</STRONG> as 2 .I want to exclude the empty values from the mv fields</P> Mon, 15 Apr 2024 13:01:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684240#M233572 karthi2809 2024-04-15T13:01:31Z Re: How to exclude null values in mv fields? https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684249#M233579 <P>Are these multivalue fields within the same event?</P><P>By "empty" do you mean they contain the word "empty" or that they have no value (empty string) or that they don't exist?</P><P>Please share some sample (anonymised) events to illustrate what you mean.</P> Mon, 15 Apr 2024 14:34:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684249#M233579 ITWhisperer 2024-04-15T14:34:09Z Re: How to exclude null values in mv fields? https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684255#M233584 <P>Its empty in the field .Attached screenshot. For some of the transaction we have multiple error type with empty values and with values.</P><P>For the same transaction below events are there with empty and with value.</P><LI-CODE lang="markup">"timestamp" : "2024-03-21T17:33:53.993Z", "content" : { "ErrorType" : "", "ErrorMsg" : "" } "timestamp" : "2024-03-21T17:33:20.786Z", "content" : { "ErrorType" : "HTTP:NOT_FOUND", "ErrorMsg" : "HTTP /glimport' failed: not found (404)." },</LI-CODE> Mon, 15 Apr 2024 14:44:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684255#M233584 karthi2809 2024-04-15T14:44:55Z Re: How to exclude null values in mv fields? https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684256#M233585 <LI-CODE lang="markup">| where ErrorType != ""</LI-CODE> Mon, 15 Apr 2024 14:48:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-exclude-null-values-in-mv-fields/m-p/684256#M233585 ITWhisperer 2024-04-15T14:48:54Z