Splunk Search

How to exclude events with null fields in a search?

lbogle
Contributor

Hello Splunkers,
I've got a search built thats working properly but I'm not able to get the events with a particular blank field excluded. In particular, I'm trying to exclude events that have a blank System Name field. I was trying to do it thusly:

search | where isnull(System Name)

Is that wrong?

Thanks,

Tags (4)
1 Solution

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

View solution in original post

gsopkoTC
Path Finder

I know this is a bit late, but possibly:

field!=null

lguinn2
Legend

null is not a reserved word in Splunk. So your solution may appear to work, but it is actually testing

field!="null"

In the search command, the text following an equal sign is considered a string.

But it probably works in your application.

dcagatay
Explorer

In my case, field search with asterisk(*) didn't work, but using not equal to empty string worked.

fieldA!=""

jakeblack
Explorer

This sorted me right out! Thanks

0 Karma

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

lbogle
Contributor

There are supposed to be asterix marks after the ='s above....

0 Karma

lbogle
Contributor

I see. So if you have fieldA=* it will only return events with fieldA=* where fieldA actually has "anything" in and not "nothing" or blank space. Is that correct?

Would the correct syntax for the way I put it first be?:

search | where isnotnull(hostname)

Thanks for your time!

0 Karma

lguinn2
Legend

Yes, fieldA=* means "fieldA must have a value." Blank space is actually a valid value, hex 20 = ASCII space - but blank fields rarely occur in Splunk.

Yes, you can use isnotnull with the where command. But it is most efficient to filter in the very first search command if possible.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...