Getting Data In

delete events that have a certain field empty?

halperkins
New Member

here is the scenario:
http://tinypic.com/r/1ax08/6

how can i delete the events for which the field is empty?

thanks

EDIT:
btw, i do not want to do the "delete" command which would delete the data from the actual server. I just want it removed from the search result

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In order to remove events from the search result when field is empty you could just add field=* to your search.

martin_mueller
SplunkTrust
SplunkTrust

field=* means "field is anything but empty".

0 Karma

horsefez
Motivator

@martin_mueller
How is this right?
For my understanding this means the fields value could by anything.

0 Karma

sowings
Splunk Employee
Splunk Employee

| where isnull(<field>)

gfrjonp
Explorer
  • Edit, didnt read all the way, above is correctomundo.

source= | where isnull(B)

0 Karma

sirisk
New Member

It worked for me

0 Karma
Get Updates on the Splunk Community!

Manual Instrumentation with Splunk Observability Cloud: The What and Why

If you've ever worked with distributed systems, you’ve likely felt the pain of a frontend throwing errors, ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...