Splunk Enterprise Security

How to identify null valued fields in the index?



How can we effectively search for fields containing null values in the index, in order to limit license entitlement. What approach can be taken to accomplish this?



Labels (2)
0 Karma



Usually if you have null() value on event it means that it has not stored into index. This also means that it's not counted to license usage as its length is 0.

In most cases fields are define on search time based on different props and transforms configurations. As those are extracted on search time those are not counted towards license usage.

r. Ismo

0 Karma


Hello @AL3Z, The best way would be using isnull as documented here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/InformationalFunctions#isnu...


Feel free to accept answer if this helps!

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...