Getting Data In
Highlighted

delete events that have a certain field empty?

New Member

here is the scenario:
http://tinypic.com/r/1ax08/6

how can i delete the events for which the field is empty?

thanks

EDIT:
btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result

Tags (1)
0 Karma
Highlighted

Re: delete events that have a certain field empty?

Splunk Employee
Splunk Employee

| where isnull(<field>)

Highlighted

Re: delete events that have a certain field empty?

Explorer
  • Edit, didnt read all the way, above is correctomundo.

source= | where isnull(B)

0 Karma
Highlighted

Re: delete events that have a certain field empty?

New Member

It worked for me

0 Karma
Highlighted

Re: delete events that have a certain field empty?

SplunkTrust
SplunkTrust

In order to remove events from the search result when field is empty you could just add field=* to your search.

Highlighted

Re: delete events that have a certain field empty?

SplunkTrust
SplunkTrust

@martin_mueller
How is this right?
For my understanding this means the fields value could by anything.

0 Karma
Highlighted

Re: delete events that have a certain field empty?

SplunkTrust
SplunkTrust

field=* means "field is anything but empty".

0 Karma