Splunk Enterprise Security

How to show results with null values and another value with wildcard?

tromero3
Path Finder

I have a field called "bunit" and I need to filter on results that either have a null value OR a value that contains "servers". I need to use wildcard with the servers because all the results are different, I just need to see anything that contains servers in it.

Adding where isnull(bunit) to the end of my search gives me all of the null results but how do I add the part where I look for any result with servers as a value?(using wildcard) So I want it to show both any field with null value or any field that contains servers in it.

Thank you!

0 Karma
1 Solution

jpolvino
Builder

You could try the like command:

Example:
where isnull(bunit) OR like(bunit,"%wildcard_is_pct%")

Here is the manpage

View solution in original post

0 Karma

jpolvino
Builder

You could try the like command:

Example:
where isnull(bunit) OR like(bunit,"%wildcard_is_pct%")

Here is the manpage

0 Karma

tromero3
Path Finder

This works, thank you 🙂

Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...