How to Remove Rows With "NULL"?

jpfrancetic · ‎04-12-2022

Greetings Splunk Community,

I am currently working on a search and I am trying to drop rows that have "NULL" in them. The problem I am running into is that some of my rows with "NULL" have things like "nullnullNULL" or "nullNULL". Is there a way i can remove the any row that has the "NULL" value regardless of other info in it?

Thanks in advance!

PickleRick · ‎04-12-2022

If you want to exclude all events that have the string NULL (case sensitive) anywhere in them, do

| regex _raw!="NULL"

You can also match against single fields

How to Remove Rows With "NULL"?

fields

regex

table

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Join the Conversation

How to Remove Rows With "NULL"?

fields

regex

table

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Data Outage Monitoring and Reporting

Manage Datasets and Connections in Catalog on Splunk Cloud Platform

Persistent Queue at TcpOut — One of Splunk's Most Practical Features