Splunk Search

Can you help me use the tstats command with a fillnull?

chris94089
Path Finder

Greetings,

So, I want to use the tstats command. It's super fast and efficient. But not if it's going to remove important results. Any record that happens to have just one null value at search time just gets eliminated from the count. That's important data to know.

With classic search I would do this:

index=* mysearch=*
| fillnull value="null" field1 field2 (etc...)
| stats count by field1 field2 (etc...)

with this, I see my events, and if one shows up as "null" in a couple fields, well, I know it was empty!

Can this be accomplished with the tstats command? Thank you so much.

Sincerely,
A want-to-be tstats advocate

kamlesh_vaghela
SplunkTrust
SplunkTrust

@chris94089

Can you please try this?

|tstats count values(field1) as field1 values(field2) as field2 where index=YOUR_INDEX by _time | fillnull field1 field2 value="NULL" | stats sum(count) as count by  field1 field2

My Sample Search:

|tstats count values(component) as component where index=_internal by _time index | fillnull component value="NULL" | stats sum(count) as count by  component

Thanks

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @kamlesh_vaghela,

It looks like only those fields we can use with tstats which is extracted at time of indexing, as I am running walklex on _internal index bucket and I can see component field in tsidx file so we can use that in tstats but not other fields like bytes from _internal index with above query (If we use datamodel then we can definitely use that 🙂 but without datamodel I think tstats limits with only fields which are extracted at index time)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...