Splunk Search

Finding the number of null cells in a table

P3G4SUS
New Member

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@P3G4SUS - You can do that like this:

....
| eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0)
| stats sum(empty_cells) as total_empty_cells

 

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't, addcoltotals doesn't work like that.

Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...