Splunk Search

How to exclude events with null fields in a search?

lbogle
Contributor

Hello Splunkers,
I've got a search built thats working properly but I'm not able to get the events with a particular blank field excluded. In particular, I'm trying to exclude events that have a blank System Name field. I was trying to do it thusly:

search | where isnull(System Name)

Is that wrong?

Thanks,

Tags (4)
1 Solution

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

View solution in original post

gsopkoTC
Path Finder

I know this is a bit late, but possibly:

field!=null

lguinn2
Legend

null is not a reserved word in Splunk. So your solution may appear to work, but it is actually testing

field!="null"

In the search command, the text following an equal sign is considered a string.

But it probably works in your application.

0 Karma

dcagatay
Explorer

In my case, field search with asterisk(*) didn't work, but using not equal to empty string worked.

fieldA!=""

jakeblack
Explorer

This sorted me right out! Thanks

0 Karma

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

View solution in original post

lbogle
Contributor

There are supposed to be asterix marks after the ='s above....

0 Karma

lbogle
Contributor

I see. So if you have fieldA=* it will only return events with fieldA=* where fieldA actually has "anything" in and not "nothing" or blank space. Is that correct?

Would the correct syntax for the way I put it first be?:

search | where isnotnull(hostname)

Thanks for your time!

0 Karma

lguinn2
Legend

Yes, fieldA=* means "fieldA must have a value." Blank space is actually a valid value, hex 20 = ASCII space - but blank fields rarely occur in Splunk.

Yes, you can use isnotnull with the where command. But it is most efficient to filter in the very first search command if possible.

0 Karma