Splunk Enterprise

How to separate null and 0 value

Julia1231
Communicator

Hi everyone,

I want to process the delta which is null in the middle of a time series by taking the next delta after the null to divide to the (count of null + 1)
Here is the data:

timeidvaluedelta
01/02/202212312 
02/02/2022123153
03/02/2022123205
04/02/2022123  
05/02/2022123  
06/02/2022123  
07/02/20221236040
08/02/2022123600
09/02/2022123  
10/02/2022123  
01/02/202214520 
02/02/20221455030
03/02/20221457020
04/02/202214510030
05/02/2022145  
06/02/2022145  
07/02/202214519090
08/02/2022145  
09/02/2022145  
10/02/2022145  
01/02/202298750 
02/02/202298710050
03/02/202298716060
04/02/202298720040
05/02/202298723030
06/02/202298728050
07/02/202298736080
08/02/202298742060
09/02/202298750080
10/02/202298755050

 

Here is when I untable

time123145987
01/02/2022000
02/02/202233050
03/02/202252060
04/02/2022103040
05/02/2022103030
06/02/2022103050
07/02/2022103080
08/02/20220060
09/02/2022 080
10/02/2022 050


As in the table, there is 1 record in 08/02/2022 when delta is 0. For other data where it doesn't have data, it is null --> ok
But for id=145, delta from 08 to 10/02 should be empty.
So that when I calculate the avg(delta), it will not effect.

So my question is how to distinguish the zero and the null in this case?

Thanks!

Labels (1)
Tags (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How did you get from your first table to your second table?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...

Index This | How many sevens are there between 1 and 100?

August 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...