Splunk Enterprise

How do I find a number of non-null values and put them in a column?

mistydennis
Communicator

I have a search that pulls values for 5 fields, some of which have a value and some that are null. I would like to create a new column ("totalrev") that counts the number of non-null values.

| inputlookup foo 
| search  field1=* OR field2=* OR field3=* OR field4=* OR field5=* 
| table field1, field2, field3, field4, field5, totalrev

How do I get a number into the "totalrev" column that will count the number of non-null values found in fields 1 - 5?

Tags (1)
0 Karma
1 Solution

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

View solution in original post

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

mistydennis
Communicator

Yes! That's what I needed - thank you so much!

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...