Splunk Search

How can I find events having NULL value related to a field?

sbhatnagar88
Path Finder

Hi,

I am trying to find all the events related to a field where value is NULL.

For E.g., say a field has multiple values like:

abc
def
mno
         -- This is NULL value
xyz
           -- This is NULL value
pqr.

I am trying to search via the below query, but that's not working.
Here parent_incident is field name, which contains multiple values including NULL, and I need data related to NULL values only.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" NOT parent_incident=*

Any help would be appreciable.

Thanks

0 Karma
1 Solution

sbhatnagar88
Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND isnull(parent_incident)

Thanks

View solution in original post

0 Karma

sbhatnagar88
Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND isnull(parent_incident)

Thanks

0 Karma

vnravikumar
Champion

What is the response you are getting?

0 Karma

sbhatnagar88
Path Finder

no data coming up with this condition ...

0 Karma

vnravikumar
Champion

Please confirm whether you have data for February month and time range what you had selected

0 Karma

sbhatnagar88
Path Finder

yes, we have because when I remove isnull(parent_incident) condition, it shows me data and parent_incident has NULL value as well..

0 Karma

vnravikumar
Champion

Hi @sbhatnagar88

Try like

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" | where isnull(parent_incident) 
0 Karma

vnravikumar
Champion

It has to work

| makeresults 
| eval test= null(),test1="sample" 
| where strftime(_time,"%B %Y")="March 2019" AND isnull(test)
0 Karma

vnravikumar
Champion

Please confirm whether parent_incident contains null values by removing strftime(_time,"%B %Y")="February 2019" in your search

Also, try

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND parent_incident=""

0 Karma

sbhatnagar88
Path Finder

Hi,
below one worked .. i tried all these yesterday but they didn't work for me because I gave space between double quotes. without spaces it showed me data related to NULL values

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(_time,"%B %Y")="February 2019" AND parent_incident=""

Thanks Much!!

0 Karma

vnravikumar
Champion

Good to hear. Please accept the answer.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...