Getting Data In

How to detect an empty field ?

Jasmine
Path Finder

I have the field called Error and if there is error we get  error message if there is no error it will be empty
eg: Value for Error is E00000 duplicate key error

i have tried as below to add status if error thrown it is Failure else Success

 

| eval Status=case(len(Error)=='', "Success",len(Error)>0, "Failure")

 

It doesnt print Success  in Status where there is not error (Error is empty) Message

i tried below:

 

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

 


it prints Success and Failure for Failure state

seems isnull satisfied for both the conditions. Please advise.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you please share example (sanitized) events, both success and failure?  It may help us to see the full query, also.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Jasmine
Path Finder

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"

Please find sample data below:

First data, it should return Failure

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"

Second data, it should return Success as not error here

"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"

 i tried as below, but not working

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

| eval Status=case(len(Error)<0, "Success",len(Error)>0, "Failure")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The evals use the Error field, but have you confirmed the field exists?  Please show the SPL prior to the eval.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...