Splunk Search

Data Model: TStats time-functions get latest NOT NULL

Path Finder


I'm having trouble retrieving my fields from an accelerated data model.
The main problem is that most of the fields are optional...
lets say the corresponding sourcetype looks like this:

  • asset_type (required)
  • asset_id (required)
  • sensor_01 (optional)
  • sensor_02 (optional)

then two events could look like this:

assettype / assetid / sensor01 / sensor02
"123" / "007" / "12.75" / ""
"123" / "007" / "" / "1265.99"

Now, when i search via the tstats command like this:

| tstats summariesonly=t
| rename dm_main.* AS *

I only get either a value for sensor01 OR sensor02, since the latest value for the other is a blank...
I tried reaching around that by using list(), but its not available for tstats.
Then I tried using values(), which gives me the values I need, but in alphabetically order. But I need to know the lastest.

Is there a way with tstats to search for LATEST NOT NULL?

additional info:

the fields in Question are not native to the sourcetype, they are calculated fields:

EVAL-sensor_01 = if(valueName="raw_sensor_01", value, "")
EVAL-sensor_02 = if(valueName="raw_sensor_02", value, "")
0 Karma

Path Finder

Okay, It seems like I need to change:
EVAL-sensor01 = if(valueName="rawsensor_01", value, "")

EVAL-sensor01 = if(valueName="rawsensor_01", value, NULL)

0 Karma


You are on the correct path, you should avoid using empty sets in any fields unless some very specific use cases. Your evals should be this EVAL-sensor_01 = if(valueName="raw_sensor_01", value, null()) The null() command makes it a null value instead of an empty set.

If this comment/answer was helpful, please up vote it. Thank you.
0 Karma