topic Re: how to deal with NA values in results in splunk? in Splunk Search

how to deal with NA values in results in splunk?

m_vivek — Wed, 11 Nov 2015 21:54:02 GMT

My splunk search is something like this

index=pqr host=xyz* NOT TYPE="*ABCDE*" | fields X, Y |timechart limit=0 span=10m count, avg(X) by Y | r " input = data    . . . calculations . . .  output =mydataframe"

the results i see in splunk after the search resembles this

I want to go from above results in above picture to the ones in the picture below

In R to achieve the data transformation from picture one to picture two, all I do is

mydataframe<-mydataframe[complete.cases(mydataframe), ]

The above does nothing but a subset on all rows of the original dataframe ignoring completely all rows that have atleast one NA in it , leaving me with just the rows that don't have any NA present in them.

How do I achieve this transformation from first picture to the second using splunk processing language?

Re: how to deal with NA values in results in splunk?

bmacias84 — Wed, 11 Nov 2015 22:01:52 GMT

This can be accomplished with the fillnull command.

http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Fillnull

Re: how to deal with NA values in results in splunk?

gcato — Wed, 11 Nov 2015 22:21:04 GMT

You can add a where or search clause to filter out fields with NA values. For example

... search output ...| where C!="NA" OR C1!="NA" OR ... and so on

Re: how to deal with NA values in results in splunk?

ppablo — Wed, 11 Nov 2015 23:42:48 GMT

Hi @m_vivek

I noticed you upvoted both Answers, but didn't accept either one. If a user has answered your question (any of your questions, not just this one), don't forget to officially accept it by clicking "Accept" directly below the answer. If there is more than one answer, choose the one that best answered your question. Otherwise, the post will just appear as unresolved when other users are searching for solutions to similar issues. Thanks!