Splunk Enterprise

How to separate null and 0 value

Julia1231
Communicator

Hi everyone,

I want to process the delta which is null in the middle of a time series by taking the next delta after the null to divide to the (count of null + 1)
Here is the data:

timeidvaluedelta
01/02/202212312 
02/02/2022123153
03/02/2022123205
04/02/2022123  
05/02/2022123  
06/02/2022123  
07/02/20221236040
08/02/2022123600
09/02/2022123  
10/02/2022123  
01/02/202214520 
02/02/20221455030
03/02/20221457020
04/02/202214510030
05/02/2022145  
06/02/2022145  
07/02/202214519090
08/02/2022145  
09/02/2022145  
10/02/2022145  
01/02/202298750 
02/02/202298710050
03/02/202298716060
04/02/202298720040
05/02/202298723030
06/02/202298728050
07/02/202298736080
08/02/202298742060
09/02/202298750080
10/02/202298755050

 

Here is when I untable

time123145987
01/02/2022000
02/02/202233050
03/02/202252060
04/02/2022103040
05/02/2022103030
06/02/2022103050
07/02/2022103080
08/02/20220060
09/02/2022 080
10/02/2022 050


As in the table, there is 1 record in 08/02/2022 when delta is 0. For other data where it doesn't have data, it is null --> ok
But for id=145, delta from 08 to 10/02 should be empty.
So that when I calculate the avg(delta), it will not effect.

So my question is how to distinguish the zero and the null in this case?

Thanks!

Labels (1)
Tags (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How did you get from your first table to your second table?

0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...