Splunk Enterprise

How to separate null and 0 value

Julia1231
Communicator

Hi everyone,

I want to process the delta which is null in the middle of a time series by taking the next delta after the null to divide to the (count of null + 1)
Here is the data:

timeidvaluedelta
01/02/202212312 
02/02/2022123153
03/02/2022123205
04/02/2022123  
05/02/2022123  
06/02/2022123  
07/02/20221236040
08/02/2022123600
09/02/2022123  
10/02/2022123  
01/02/202214520 
02/02/20221455030
03/02/20221457020
04/02/202214510030
05/02/2022145  
06/02/2022145  
07/02/202214519090
08/02/2022145  
09/02/2022145  
10/02/2022145  
01/02/202298750 
02/02/202298710050
03/02/202298716060
04/02/202298720040
05/02/202298723030
06/02/202298728050
07/02/202298736080
08/02/202298742060
09/02/202298750080
10/02/202298755050

 

Here is when I untable

time123145987
01/02/2022000
02/02/202233050
03/02/202252060
04/02/2022103040
05/02/2022103030
06/02/2022103050
07/02/2022103080
08/02/20220060
09/02/2022 080
10/02/2022 050


As in the table, there is 1 record in 08/02/2022 when delta is 0. For other data where it doesn't have data, it is null --> ok
But for id=145, delta from 08 to 10/02 should be empty.
So that when I calculate the avg(delta), it will not effect.

So my question is how to distinguish the zero and the null in this case?

Thanks!

Labels (1)
Tags (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How did you get from your first table to your second table?

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...