How to identify null valued fields in the index?

[AL3Z]

Hi,

How can we effectively search for fields containing null values in the index, in order to limit license entitlement. What approach can be taken to accomplish this?

Thanks

[isoutamo]

Hi

Usually if you have null() value on event it means that it has not stored into index. This also means that it's not counted to license usage as its length is 0.

In most cases fields are define on search time based on different props and transforms configurations. As those are extracted on search time those are not counted towards license usage.

r. Ismo

[meetmshah]

Hello @AL3Z, The best way would be using isnull as documented here - https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/InformationalFunctions#isnu...

Feel free to accept answer if this helps!