Splunk Search

How can I find events having NULL value related to a field?

Path Finder

Hi,

I am trying to find all the events related to a field where value is NULL.

For E.g., say a field has multiple values like:

abc
def
mno
         -- This is NULL value
xyz
           -- This is NULL value
pqr.

I am trying to search via the below query, but that's not working.
Here parent_incident is field name, which contains multiple values including NULL, and I need data related to NULL values only.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" NOT parent_incident=*

Any help would be appreciable.

Thanks

0 Karma
1 Solution

Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(time,"%B %Y")="February 2019" AND isnull(parentincident)

Thanks

View solution in original post

0 Karma

Path Finder

Hi @ vnravikumar,

i already have where condition to filter out the month so I am putting your response like this but it doesn't seems to be working.

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(time,"%B %Y")="February 2019" AND isnull(parentincident)

Thanks

View solution in original post

0 Karma

Champion

What is the response you are getting?

0 Karma

Path Finder

no data coming up with this condition ...

0 Karma

Champion

Please confirm whether you have data for February month and time range what you had selected

0 Karma

Path Finder

yes, we have because when I remove isnull(parentincident) condition, it shows me data and parentincident has NULL value as well..

0 Karma

Champion

Hi @sbhatnagar88

Try like

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/" | where isnull(parent_incident) 
0 Karma

Champion

It has to work

| makeresults 
| eval test= null(),test1="sample" 
| where strftime(_time,"%B %Y")="March 2019" AND isnull(test)
0 Karma

Champion

Please confirm whether parent_incident contains null values by removing strftime(_time,"%B %Y")="February 2019" in your search

Also, try

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(time,"%B %Y")="February 2019" AND parentincident=""

0 Karma

Path Finder

Hi,
below one worked .. i tried all these yesterday but they didn't work for me because I gave space between double quotes. without spaces it showed me data related to NULL values

index=main sourcetype=snow:incident endpoint="https://server.service-now.com/"
| where strftime(time,"%B %Y")="February 2019" AND parentincident=""

Thanks Much!!

0 Karma

Champion

Good to hear. Please accept the answer.

0 Karma