Splunk Search

Find null values in multivalue fields

luna
Explorer

Hello,

Need to find null values from multivalue field. I am using mvcount to get all the values I am interested for the the events field I have filtered for. However, I get all the events I am filtering for. What I am really after is seeing where event=A is null. Would like to see event output the value that is null, like: Null, B, C, D wherever A is null. Any suggestions?

 

| index="dc_green_idx" event=A OR event=B OR event=C OR event=D

| eval Unsupp=case(event="A", TimeSubmitted)

| eval BUnsupp=if(isnull(Unsupp),"yes","no")

| stats  latest(TimeSubmitted) as TimeSubmitted  values(event) as event max(BUnsupp) as BUnsupp by invite | sort -TimeSubmitted

| where mvcount(event)>3 AND isnull(Unsupp)

 

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Unsupp is not passed through the stats command so will always be null - if all 4 event types are present, mvcount will be > 3 i.e. A was present (and not null). You need to pass Unsupp through stats (values(Unsupp) as Unsupp) and you need to be looking for results where mvcount < 4

luna
Explorer

@ITWhisperer 

 

I would like where I at least have two event values, because the second value is dependent on the third. So at least I should see event=b and event=c  I think mvcount >=2 would do it, since I can at least get the 2 values then if I’m missing event=a from those 2 I know a is null...  is my thought process correct? 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That sounds a good approach

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...