Splunk Search

Get top values with null empty fields

locguero
Engager

Hello. I am new to splunk and regex so please bear with me. I have the following log file format

iNRPMPLANTCD: AR| iNDATETYPE: lastShift| iNTESTSTARTDATE: | iNTESTENDDATE: | iNINTERVALNBR: 1| 

I defined my fields with the following regex

(?i) iNRPMPLANTCD: (?P<iNRPMPLANTCD>[^\|]+)
(?i) iNDATETYPE: (?P<iNDATETYPE>[^\|]+)
(?i) iNTESTSTARTDATE: (?P<iNTESTSTARTDATE>[^\|]+)
(?i) iNTESTENDDATE: (?P<iNTESTENDDATE>[^\|]+)
(?i) iNINTERVALNBR: (?P<iNINTERVALNBR>[^\|]+)
  • PNAME=XBarAssembler ActivityId !=null STATUS=DEBUG | top limit=50000 iNRPMPLANTCD,iNTESTPGMCD, iNDATETYPE, iNLASTXOPTNS, iNINTERVALNBR

When I try and do a top so see the usage patterns the records that have null/empty fields are not counted. I want to count these. I have tried to use the fillnull value="Null" and I have tried eval to replace the null value with a value... eval LastOptions = if(iNLASTXOPTNS=="","Null",iNLASTXOPTNS) but I can't seem to figure out what is being held in the field to replace it with a string so it will be counted. Any help is greatly appreciated

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this

PNAME=XBarAssembler ActivityId !=null STATUS=DEBUG | eval iNRPMPLANTCD=coalesce(iNRPMPLANTCD,"NULL")| eval iNTESTPGMCD=coalesce(iNTESTPGMCD,"NULL")| eval iNDATETYPE=coalesce(iNDATETYPE,"NULL")| eval iNLASTXOPTNS=coalesce(iNLASTXOPTNS,"NULL")| eval iNINTERVALNBR=coalesce(iNINTERVALNBR,"NULL")| top limit=50000 iNRPMPLANTCD,iNTESTPGMCD, iNDATETYPE, iNLASTXOPTNS, iNINTERVALNBR

View solution in original post

somesoni2
Revered Legend

Try this

PNAME=XBarAssembler ActivityId !=null STATUS=DEBUG | eval iNRPMPLANTCD=coalesce(iNRPMPLANTCD,"NULL")| eval iNTESTPGMCD=coalesce(iNTESTPGMCD,"NULL")| eval iNDATETYPE=coalesce(iNDATETYPE,"NULL")| eval iNLASTXOPTNS=coalesce(iNLASTXOPTNS,"NULL")| eval iNINTERVALNBR=coalesce(iNINTERVALNBR,"NULL")| top limit=50000 iNRPMPLANTCD,iNTESTPGMCD, iNDATETYPE, iNLASTXOPTNS, iNINTERVALNBR

locguero
Engager

Man you are awesome! That is exactly what I needed. Works like a charm.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...