Splunk Search

Finding the number of null cells in a table

P3G4SUS
New Member

Lets say I have a table of two fields. and some of the cells are empty.
How do I find the number of empty cells using "addcoltotals"

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@P3G4SUS - You can do that like this:

....
| eval empty_cells = case(isnull(A) AND isnull(B), 2, isnull(A), 1, isnull(B), 1, 1==1, 0)
| stats sum(empty_cells) as total_empty_cells

 

I'm assuming your two fields in the table is A and B, but you can replace that with what you have in above query and you should get your answer.

 

I hope this helps!!!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can't, addcoltotals doesn't work like that.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...