topic Re: Get top values with null empty fields in Splunk Search

Get top values with null empty fields

locguero — Tue, 26 Aug 2014 16:24:38 GMT

Hello. I am new to splunk and regex so please bear with me. I have the following log file format

iNRPMPLANTCD: AR| iNDATETYPE: lastShift| iNTESTSTARTDATE: | iNTESTENDDATE: | iNINTERVALNBR: 1|

I defined my fields with the following regex

(?i) iNRPMPLANTCD: (?P<iNRPMPLANTCD>[^\|]+)
(?i) iNDATETYPE: (?P<iNDATETYPE>[^\|]+)
(?i) iNTESTSTARTDATE: (?P<iNTESTSTARTDATE>[^\|]+)
(?i) iNTESTENDDATE: (?P<iNTESTENDDATE>[^\|]+)
(?i) iNINTERVALNBR: (?P<iNINTERVALNBR>[^\|]+)

PNAME=XBarAssembler ActivityId !=null STATUS=DEBUG | top limit=50000 iNRPMPLANTCD,iNTESTPGMCD, iNDATETYPE, iNLASTXOPTNS, iNINTERVALNBR

When I try and do a top so see the usage patterns the records that have null/empty fields are not counted. I want to count these. I have tried to use the fillnull value="Null" and I have tried eval to replace the null value with a value... eval LastOptions = if(iNLASTXOPTNS=="","Null",iNLASTXOPTNS) but I can't seem to figure out what is being held in the field to replace it with a string so it will be counted. Any help is greatly appreciated

Re: Get top values with null empty fields

somesoni2 — Tue, 26 Aug 2014 17:20:48 GMT

Try this

PNAME=XBarAssembler ActivityId !=null STATUS=DEBUG | eval iNRPMPLANTCD=coalesce(iNRPMPLANTCD,"NULL")| eval iNTESTPGMCD=coalesce(iNTESTPGMCD,"NULL")| eval iNDATETYPE=coalesce(iNDATETYPE,"NULL")| eval iNLASTXOPTNS=coalesce(iNLASTXOPTNS,"NULL")| eval iNINTERVALNBR=coalesce(iNINTERVALNBR,"NULL")| top limit=50000 iNRPMPLANTCD,iNTESTPGMCD, iNDATETYPE, iNLASTXOPTNS, iNINTERVALNBR

Re: Get top values with null empty fields

locguero — Tue, 26 Aug 2014 18:08:39 GMT

Man you are awesome! That is exactly what I needed. Works like a charm.