Getting Data In

find absence of data in splunk - iis

benj851
Explorer

Hello; 

 

We ingest IIS logs. Recently some of our iis calls lately haven't included the required username, causing the call to fail. I am trying to find a way in splunk to query the absence of the cs_username field. But, because the field doesn't populate in the iis call when there's no username present, I'm stuck. So searching for a null value does nothing.

 

I would greatly appreciate any assistance.  

Labels (1)
Tags (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @benj851,

Did you try below?

| where isnull(cs_username)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @benj851,

Did you try below?

| where isnull(cs_username)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...