topic Re: What is the best way to search for blank (null) fields in a search? in Splunk Search

What is the best way to search for blank (null) fields in a search?

hastrike — Mon, 22 Feb 2016 19:04:37 GMT

Is there a best way to search for blank fields in a search? isnull() or ="" doesn't seem to work. Is there way to do this? The only thing we have been able to do is do a f-llnull and then search for those fields we filled in those fields with a specific term.

Re: What is the best way to search for blank (null) fields in a search?

somesoni2 — Mon, 22 Feb 2016 19:20:41 GMT

The isnull should work fine, if you're able to use fillnull. Could you post the search that you tried with fillnull?

Re: What is the best way to search for blank (null) fields in a search?

hastrike — Tue, 29 Sep 2020 08:51:14 GMT

I am actually asking on behalf of co-worker. We would like not have to fill in the blank space we just want to find all the fields where it is blank. IsNull didn't seem to be working. The only thing he seemed to be able to use is fillnull (| fillnull value="Blank" dv_install_status) then then search for the field where it said blank. Is there any way to search for blank fields with out doing fill null?

Re: What is the best way to search for blank (null) fields in a search?

somesoni2 — Mon, 22 Feb 2016 19:32:39 GMT

If the fillnull is working, I would give this a try

your base search | where isnull(dv_install_status)

Re: What is the best way to search for blank (null) fields in a search?

hastrike — Tue, 29 Sep 2020 08:51:17 GMT

so just checking is that searching field dv_install_status for any fields that is null?

Re: What is the best way to search for blank (null) fields in a search?

gyslainlatsa — Mon, 22 Feb 2016 19:47:26 GMT

hi hastrike,

use NOT field="*"

for more informations, follow this link:

https://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields.html

Re: What is the best way to search for blank (null) fields in a search?

somesoni2 — Tue, 29 Sep 2020 08:51:20 GMT

It's just selecting events where dv_install_status is null.

Re: What is the best way to search for blank (null) fields in a search?

hastrike — Tue, 29 Sep 2020 08:51:22 GMT

so if you wanted to search for two fields such as NULL and inuse would it be something like this:
NOT dv_install_status="*" OR dv_install_status="In use" ?

Re: What is the best way to search for blank (null) fields in a search?

gyslainlatsa — Mon, 22 Feb 2016 20:05:08 GMT

"In use" is a value of *

just write NOT dv_install_status="*"

Re: What is the best way to search for blank (null) fields in a search?

hastrike — Mon, 22 Feb 2016 20:10:17 GMT

We just want to find all the fields with In use as the event or if the field is null. Won't this find any event with the * since that is thee wild card?

Re: What is the best way to search for blank (null) fields in a search?

gyslainlatsa — Tue, 29 Sep 2020 08:51:25 GMT

NOT dv_install status = "*" will find all the events wherethe value of the field dv_install_status is empty or zero.

try and see the results because I have already used this option

Re: What is the best way to search for blank (null) fields in a search?

gyslainlatsa — Mon, 22 Feb 2016 20:41:58 GMT

thanks, don't forget to vote

Re: What is the best way to search for blank (null) fields in a search?

nigel_pearson_a — Thu, 05 Apr 2018 07:09:38 GMT

Old question, but isnull does work for me. These two searches are equivalent:

index=cers  A_Number=04*   | where isnull(MoLiIn)

index=cers  A_Number=04*   NOT MoLiIn=*

Re: What is the best way to search for blank (null) fields in a search?

ehennessey_splu — Tue, 14 May 2019 12:45:18 GMT

To expand on this, since I recently ran into the very same issue. If you have a search time field extraction and an event that should contain the field but doesn't, you can't do a search for fieldname="" because the field doesn't get extracted if it's not there.

But if you search for events that should contain the field and want to specifically find events that don't have the field set, the following worked for me (the index/sourcetype combo should always have fieldname set in my case):

index=myindex sourcetype=mysourcetype NOT fieldname=*

All of which is a long way of saying make sure you include search criteria that should always find events with that field set.