Splunk Search

How do I pull a stats table where there are blank fields in event data?

reneedeleon
Engager

This is the event data:
ls1=INFO ls1Label=Severity ls2=MS SQL SERVER ls2Label=ServerType ls3=Command List ls3Label= cat=Audit sproc=ubuntu user=billy uid=DOMAIN\billybob dest= lhost=abrokenserver ohost=serverconnectedto CMD=su apt install *

index=rootCMDs
| rex field=_raw "^[^ \n]* (?P[^ ]+)"
| rex field=_raw "^(?:[^|\n]|){5}(?P[^|]+)"
| rex field=_raw "ls3label=(?.
)\scat="
| eval ls3label=case(isnull(ls3label),"NULL",1=1,dst)
| where isnotnull(ls3label)
| search dst=" "
| stats count by lhost, ls3label, sproc. user, uid
| sort 0 count desc

When I pull the stats count I get no data but the even data lists everything and has hundreds of events where *="no data". How do I specifically search for the blank data only? Or is my search improperly formatted?

Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@reneedeleon

Have you tried `fillnull' command to assigned default value instead of keeping null value?

http://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Fillnull

| fillnull value="NA" lhost, ls3label, sproc. user, uid
| stats count by lhost, ls3label, sproc. user, uid
0 Karma

DalJeanis
Legend

Converted comment to answer because that's the answer.

0 Karma

reneedeleon
Engager

Thank you Dal,

 Let me ask another question to the answer. Is it plausible to search multiple fields where there is data and NULL values. 

maybe:

| search *=NULL OR | where *=NULL

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...