https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175451#M50371 <P>I'm trying unsuccessfully to select events with fields with empty values.</P> <P>How can this be accomplished?</P> <P>My events:</P> <P>....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|<BR /> ....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|<BR /> ....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|</P> <P>So I need to search the events with errorDesc='empty', like the last 2 events.</P> <P>I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.</P> <P>I will appreciate any help/guidance.</P> Thu, 07 Aug 2014 21:40:06 GMT snemiro_514 2014-08-07T21:40:06Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175451#M50371 <P>I'm trying unsuccessfully to select events with fields with empty values.</P> <P>How can this be accomplished?</P> <P>My events:</P> <P>....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|<BR /> ....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|<BR /> ....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|</P> <P>So I need to search the events with errorDesc='empty', like the last 2 events.</P> <P>I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.</P> <P>I will appreciate any help/guidance.</P> Thu, 07 Aug 2014 21:40:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175451#M50371 snemiro_514 2014-08-07T21:40:06Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175452#M50372 <P>Hi @snemiro_514</P> <P>Have you tried a solution similar to this post?<BR /> <A href="http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields">http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields</A></P> <P>So try:</P> <PRE><CODE>your search... NOT errorDesc="*" </CODE></PRE> Thu, 07 Aug 2014 21:58:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175452#M50372 ppablo 2014-08-07T21:58:18Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175453#M50373 <P>Hi, yep!...that worked. I also have found a workaround...</P> <P>index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"</P> <P>Gracias!</P> Thu, 07 Aug 2014 23:24:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175453#M50373 snemiro_514 2014-08-07T23:24:37Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175454#M50374 <P>No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 07 Aug 2014 23:27:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175454#M50374 ppablo 2014-08-07T23:27:58Z https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175455#M50375 <P>Thanks for fillnull and search commands!</P> Thu, 07 Jun 2018 07:26:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-for-fields-with-empty-values/m-p/175455#M50375 edgars 2018-06-07T07:26:37Z