Splunk Search

Finding the number of null cells in a table

P3G4SUS
New Member

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@P3G4SUS - You can do that like this:

....
| eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0)
| stats sum(empty_cells) as total_empty_cells

 

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't, addcoltotals doesn't work like that.

Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...