Splunk Search

Finding the number of null cells in a table

P3G4SUS
New Member

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@P3G4SUS - You can do that like this:

....
| eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0)
| stats sum(empty_cells) as total_empty_cells

 

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't, addcoltotals doesn't work like that.

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...