Splunk Search

Hiding null value results

Bo3432
Explorer

Hello,

I am trying to find a command that will allow me to create a table and only display values. when using the user agent field in my table, there are some values that are null. I only want values to display. 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Yes, it can be used with a table and all other visualizations.

When you say "it is giving no results" does that mean the where command is not filtering as expected or you are getting nothing at all from the query?  If the former, then it's possible the userAgent field is all spaces so the filter should be modified to handle that.  For the latter, try renaming the fields to eliminate dots.

index=azure sourcetype="azure:monitor:aad" action=*
| rename properties.* as *
| where isnotnull(userAgent) AND userAgent!=""
|table _time user deviceDetail.displayName userAgent action
|sort -_time

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Use the where command to filter out results with empty fields.

| where isnotnull(user_agent) AND user_agent!=""
---
If this reply helps you, Karma would be appreciated.
0 Karma

Bo3432
Explorer

Can this be used with a table?  This is my command but it is giving no results. 

index=azure sourcetype="azure:monitor:aad" action=*
| where isnotnull(properties.userAgent) AND properties.userAgent!=""
|table _time user properties.deviceDetail.displayName properties.userAgent action
|sort -_time

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@Bo3432 The where clause takes an eval statement and in eval statements you need to wrap 'odd' field names with single quotes. In your case properties.userAgent contains a full-stop, so you need to use

| where isnotnull('properties.userAgent') AND 'properties.userAgent'!=""

richgalloway
SplunkTrust
SplunkTrust

Yes, it can be used with a table and all other visualizations.

When you say "it is giving no results" does that mean the where command is not filtering as expected or you are getting nothing at all from the query?  If the former, then it's possible the userAgent field is all spaces so the filter should be modified to handle that.  For the latter, try renaming the fields to eliminate dots.

index=azure sourcetype="azure:monitor:aad" action=*
| rename properties.* as *
| where isnotnull(userAgent) AND userAgent!=""
|table _time user deviceDetail.displayName userAgent action
|sort -_time

 

---
If this reply helps you, Karma would be appreciated.

Bo3432
Explorer

That did it. Much appreciated. 

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...