topic Re: Only show null values from timechart values(source) in Splunk Search

Only show null values from timechart values(source)

splunkreal — Mon, 10 Apr 2017 14:41:09 GMT

Hello guys,

could you tell me how to only show null cells from this kind of table, for alerting purpose?

Search: index=* host=XXX source=/var/log* | eval ... | timechart span=1d values(source) by host

Thanks.

Re: Only show null values from timechart values(source)

DalJeanis — Mon, 10 Apr 2017 14:44:52 GMT

| where isnull(myfieldname)

Re: Only show null values from timechart values(source)

splunkreal — Mon, 10 Apr 2017 14:57:41 GMT

It doesn't work, I tried values(source) as src then use | where isnull(src) but nothing changed...

| where isnull(values(source)) = 'values' function is unsupported

Re: Only show null values from timechart values(source)

somesoni2 — Mon, 10 Apr 2017 15:37:03 GMT

I would setup alert based on this search

index= host=XXX source=/var/log | eval ... | timechart span=1d values(source) by host 
| eval shouldAlert=0 | foreach * [eval shouldAlert=shouldAlert+if(isnull('<<FIELD>>') OR '<<FIELD>>'="",1,0) ]
| where shouldAlert>0

Basically it'll loop through all columns for a row and add 1 to shouldAlert field if there are null value in that rows. Later we only select rows where alert should be raised. You can then setup alert with condition 'if number of events greater than 0'

Re: Only show null values from timechart values(source)

woodcock — Mon, 10 Apr 2017 15:46:05 GMT

Just add this to the end:

| eval NULLVALUE="NO"
| foreach * [eval NULLVALUE=if(isnull(<<FIELD>>), "YES", NULLVALUE)]
| search NULLVALUE="YES"

Re: Only show null values from timechart values(source)

splunkreal — Mon, 10 Apr 2017 15:57:41 GMT

No result... I tried src, host or even source for <>

Re: Only show null values from timechart values(source)

splunkreal — Mon, 10 Apr 2017 15:58:00 GMT

Same, no result... I tried src, host or even source for <>

Re: Only show null values from timechart values(source)

somesoni2 — Mon, 10 Apr 2017 16:08:34 GMT

YOu need to use literally '<>' there. No need to replace it with any field names.

Re: Only show null values from timechart values(source)

splunkreal — Mon, 10 Apr 2017 17:03:07 GMT

Thanks a lot!

Re: Only show null values from timechart values(source)

woodcock — Mon, 10 Apr 2017 17:13:12 GMT

No, you do not need to change ANYTHING. Type it in EXACTLY as I had it and it will work.