Splunk Search

How do I search for the first occurrence of a field that is not null or empty?

faustof
Explorer

I have a field "Company Name" that is empty on some events, but has a value on others. How do I search for the first occurrence of that field that is not null or empty?

sourcetype=[my source] [filter field] = 322799761 
| table customer.companyName
0 Karma
1 Solution

sundareshr
Legend

Try this

sourcetype=[my source] [filter field] = 322799761 customer.companyName=* | table customer.companyName | head 1

View solution in original post

0 Karma

sundareshr
Legend

Try this

sourcetype=[my source] [filter field] = 322799761 customer.companyName=* | table customer.companyName | head 1
0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...