Getting Data In

How to detect an empty field ?

Jasmine
Path Finder

I have the field called Error and if there is error we get  error message if there is no error it will be empty
eg: Value for Error is E00000 duplicate key error

i have tried as below to add status if error thrown it is Failure else Success

 

| eval Status=case(len(Error)=='', "Success",len(Error)>0, "Failure")

 

It doesnt print Success  in Status where there is not error (Error is empty) Message

i tried below:

 

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

 


it prints Success and Failure for Failure state

seems isnull satisfied for both the conditions. Please advise.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you please share example (sanitized) events, both success and failure?  It may help us to see the full query, also.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Jasmine
Path Finder

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E11000 duplicate key\"}"

Please find sample data below:

First data, it should return Failure

"{\"ID\": \"123\", \"Testing\": \"5\"}"
"{\"ID\": \"123\", \"Error\": \"E00000 duplicate Error\"}"

Second data, it should return Success as not error here

"{\"ID\": \"1234\", \"Testing\": \"6\"}"
"{\"ID\": \"1234\", \"Designation\": \"Manager\"}"

 i tried as below, but not working

| eval Status=case(isnull(Error), "Success",isnotnull(Error), "Failure")

| eval Status=case(len(Error)<0, "Success",len(Error)>0, "Failure")

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The evals use the Error field, but have you confirmed the field exists?  Please show the SPL prior to the eval.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...