Getting Data In

How to detect an empty field ?

Jasmine
Path Finder

I have the field called Error and if there is error we get  error message if there is no error it will be empty
eg: Value for Error is E00000 duplicate key error

i have tried as below to add status if error thrown it is Failure else Success

 

| eval Status=case(len(Error)=='', "Success",len(Error)>0, "Failure")

 

It doesnt print Success  in Status where there is not error (Error is empty) Message

i tried below:

 

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

 


it prints Success and Failure for Failure state

seems isnull satisfied for both the conditions. Please advise.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you please share example (sanitized) events, both success and failure?  It may help us to see the full query, also.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Jasmine
Path Finder

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"

Please find sample data below:

First data, it should return Failure

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"

Second data, it should return Success as not error here

"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"

 i tried as below, but not working

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

| eval Status=case(len(Error)<0, "Success",len(Error)>0, "Failure")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The evals use the Error field, but have you confirmed the field exists?  Please show the SPL prior to the eval.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...