topic Re: Handling empty fields in format command in Splunk Search

Handling empty fields in format command

ceedwlt — Mon, 14 Sep 2015 14:57:31 GMT

I have a search that uses a subsearch to filter out certain kinds of logs. I'm using the format command to create the filter list for the base search, as so:

<base search> | where NOT [<subsearch> | fields <field> | format]

Everything works fine until there's a time period where there's nothing that needs filtering. Instead, format simply returns NOT () which causes the base search to fail with this message:

Error in 'where' command: The 'not' function is unsupported or undefined.

Is there a standard way to handle this situation? I've tried using fillnull with no success.

Thanks in advance.

Re: Handling empty fields in format command

somesoni2 — Mon, 14 Sep 2015 18:22:31 GMT

Just replace "| where" by "| search" and it should work fine.

<query> | search NOT [<sub-query> | fields <field> | format]

See this run anywhere sample search

index=_internal  earliest=-15m  | head 100 | search NOT [ search index=_internal32454  earliest=-15m | head 1| table sourcetype | makemv sourcetype | mvexpand sourcetype | format ]| stats count by sourcetype

Replace search by where to check that your error is replicated

Re: Handling empty fields in format command

woodcock — Mon, 14 Sep 2015 19:59:23 GMT

Get rid of the | where and it should work fine.

Re: Handling empty fields in format command

ceedwlt — Tue, 15 Sep 2015 09:09:01 GMT

Perfect, that solved it - thanks!

Re: Handling empty fields in format command

woodcock — Tue, 15 Sep 2015 14:27:13 GMT

As my solution indicates, you should not need either clause.

Re: Handling empty fields in format command

ceedwlt — Tue, 15 Sep 2015 14:50:46 GMT

This also works, I didn't have time to check it earlier. Thanks!