Splunk Search

Filtering out NULL values after stats not working

tumapath
New Member

I am trying to filter out null values from the result of stats. Query looks like below.

 

 

index=someindex* some
   ((somefield1=value1 AND somefield2="value2") 
     AND (somefield1=value3  
          OR (somefield2=value4  
               AND somefield1=value5
              )
         )
   )
   OR (somefield1=value6)
| eval someeval=...
| replace "some*" with "SOME" in somefield1
| bucket _time span=1d as daytime
| stats max(eval(if(somefield1=value1,_time,null()))) as val1_time
        min(eval(if(somefield1=value2,_time,null()))) as val2_time
        min(eval(if(somefield1=value3 ,_time,null()))) as val3_time
        by somefield3 somefield4 
| eval recovered_time=if(isNotNull(val2_time),val2_time,val3_time)
| where isNotNull(val1_time)

 

 

But this query returns result with null or empty val1_time also.

What could be the issue in this query? I further pass the result of this query to another stats query.  But I am stuck here.

Labels (2)
0 Karma

tumapath
New Member

Adding this line in the end does the magic. 

| where isNotNull(val1_time) AND val1_time != ""

 

0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...