Splunk Search

Data Model: TStats time-functions get latest NOT NULL

Path Finder

Hi,

I'm having trouble retrieving my fields from an accelerated data model.
The main problem is that most of the fields are optional...
lets say the corresponding sourcetype looks like this:

  • asset_type (required)
  • asset_id (required)
  • sensor_01 (optional)
  • sensor_02 (optional)

then two events could look like this:

assettype / assetid / sensor01 / sensor02
"123" / "007" / "12.75" / ""
"123" / "007" / "" / "1265.99"

Now, when i search via the tstats command like this:

| tstats summariesonly=t
latest(dm_main.sensor_01)
latest(dm_main.sensor_02)
FROM
datamodel=dm_main
by
dm_main.asset_type 
dm_main.asset_id
| rename dm_main.* AS *

I only get either a value for sensor01 OR sensor02, since the latest value for the other is a blank...
I tried reaching around that by using list(), but its not available for tstats.
Then I tried using values(), which gives me the values I need, but in alphabetically order. But I need to know the lastest.

Is there a way with tstats to search for LATEST NOT NULL?

additional info:

the fields in Question are not native to the sourcetype, they are calculated fields:

EVAL-sensor_01 = if(valueName="raw_sensor_01", value, "")
EVAL-sensor_02 = if(valueName="raw_sensor_02", value, "")
0 Karma

Path Finder

Okay, It seems like I need to change:
EVAL-sensor01 = if(valueName="rawsensor_01", value, "")

to:
EVAL-sensor01 = if(valueName="rawsensor_01", value, NULL)

0 Karma

Builder

You are on the correct path, you should avoid using empty sets in any fields unless some very specific use cases. Your evals should be this EVAL-sensor_01 = if(valueName="raw_sensor_01", value, null()) The null() command makes it a null value instead of an empty set.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma