Getting Data In

Can anyone please explain the purpose of 'usenull' keyword with an example?

gopi_c
New Member

I've have been trying to search the use of 'usenull' keyboard. Could anyone explain this please.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

From the docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/ListOfDataTypes):

usenull controls whether or not a series is created for events that do not contain the split-by field. This series is labeled by the value of the nullstr option, and defaults to NULL.

usenull is enabled by default so you only need to add usenull=f when you have a chart with "NULL" that you don't want.

---
If this reply helps you, Karma would be appreciated.

niketn
Legend

One of better ways to remove NULL series being created in the timechart/chart because of null values in the split by field is to apply field filter before the timechart/chart command.

For example try the following two run anywhere searches based on Splunk's _internal index.

index=_internal sourcetype=splunkd earliest=-30s latest=now
| timechart span=10s count by cumulative_hits limit=0 useother=f


index=_internal sourcetype=splunkd earliest=-30s latest=now cumulative_hits=* 
| timechart span=10s count by cumulative_hits limit=0 useother=f
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...