topic Show only null result in Splunk Search

Show only null result

Miguel3393 — Mon, 04 Nov 2024 23:28:51 GMT

How can I make it show me only what appears as null in the Call.CallForwardInfo.OriginalCalledAddr field? Right now I have this result, you can help me.

Re: Show only null result

richgalloway — Tue, 05 Nov 2024 01:06:35 GMT

Add | where Call.CallForwardInfo.OriginalCalledAddr="null" to the query.

Re: Show only null result

Miguel3393 — Tue, 05 Nov 2024 02:06:04 GMT

I added it but it doesn't work, it doesn't show results.

Re: Show only null result

zksvc — Tue, 05 Nov 2024 03:17:55 GMT

Maybe you can add all your condition in 1 line ?

| where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null"

Let me know if it works

Re: Show only null result

Miguel3393 — Tue, 05 Nov 2024 05:05:08 GMT

Hi,

It was added in the following way and it did not work, it does not show results.

index="cdr_cfs_index"
| search Call.OrigParty.TrunkGroup.TrunkGroupId=2601
| lookup ClientesSymSipdfntion1 Call.OrigParty.CallingPartyAddr OUTPUT cliente
| lookup ClientesSymSipdfntion2 Call.OrigParty.CallingPartyAddr OUTPUT cliente1
| fillnull value=null Call.CallForwardInfo.OriginalCalledAddr | where isnull(cliente) AND isnull(cliente1) AND Call.CallForwardInfo.OriginalCalledAddr="null"
| stats count by Call.OrigParty.CallingPartyAddr Call.CallForwardInfo.OriginalCalledAddr
| sort - Call.CallForwardInfo.OriginalCalledAddr