Getting Data In

How to detect an empty field ?

Jasmine
Path Finder

I have the field called Error and if there is error we get  error message if there is no error it will be empty
eg: Value for Error is E00000 duplicate key error

i have tried as below to add status if error thrown it is Failure else Success

 

| eval Status=case(len(Error)=='', "Success",len(Error)>0, "Failure")

 

It doesnt print Success  in Status where there is not error (Error is empty) Message

i tried below:

 

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

 


it prints Success and Failure for Failure state

seems isnull satisfied for both the conditions. Please advise.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you please share example (sanitized) events, both success and failure?  It may help us to see the full query, also.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Jasmine
Path Finder

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"

Please find sample data below:

First data, it should return Failure

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"

Second data, it should return Success as not error here

"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"

 i tried as below, but not working

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

| eval Status=case(len(Error)<0, "Success",len(Error)>0, "Failure")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The evals use the Error field, but have you confirmed the field exists?  Please show the SPL prior to the eval.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...