Splunk Search

How can I find events having NULL value related to a field?

sbhatnagar88
Path Finder

Hi,

I am trying to find all the events related to a field where value is NULL.

For E.g., say a field has multiple values like:

abc
def
mno
         -- This is NULL value
xyz
           -- This is NULL value
pqr.

I am trying to search via the below query, but that's not working.
Here parent_incident is field name, which contains multiple values including NULL, and I need data related to NULL values only.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" NOT parent_incident=*

Any help would be appreciable.

Thanks

0 Karma
1 Solution

sbhatnagar88
Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND isnull(parent_incident)

Thanks

View solution in original post

0 Karma

sbhatnagar88
Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND isnull(parent_incident)

Thanks

View solution in original post

0 Karma

vnravikumar
Champion

What is the response you are getting?

0 Karma

sbhatnagar88
Path Finder

no data coming up with this condition ...

0 Karma

vnravikumar
Champion

Please confirm whether you have data for February month and time range what you had selected

0 Karma

sbhatnagar88
Path Finder

yes, we have because when I remove isnull(parent_incident) condition, it shows me data and parent_incident has NULL value as well..

0 Karma

vnravikumar
Champion

Hi @sbhatnagar88

Try like

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" | where isnull(parent_incident) 
0 Karma

vnravikumar
Champion

It has to work

| makeresults 
| eval test= null(),test1="sample" 
| where strftime(_time,"%B %Y")="March 2019" AND isnull(test)
0 Karma

vnravikumar
Champion

Please confirm whether parent_incident contains null values by removing strftime(_time,"%B %Y")="February 2019" in your search

Also, try

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND parent_incident=""

0 Karma

sbhatnagar88
Path Finder

Hi,
below one worked .. i tried all these yesterday but they didn't work for me because I gave space between double quotes. without spaces it showed me data related to NULL values

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND parent_incident=""

Thanks Much!!

0 Karma

vnravikumar
Champion

Good to hear. Please accept the answer.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.