Splunk Search

Finding the number of null cells in a table

P3G4SUS
New Member

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@P3G4SUS - You can do that like this:

....
| eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0)
| stats sum(empty_cells) as total_empty_cells

 

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't, addcoltotals doesn't work like that.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...