Splunk Search

How to exclude events with null fields in a search?

lbogle
Contributor

Hello Splunkers,
I've got a search built thats working properly but I'm not able to get the events with a particular blank field excluded. In particular, I'm trying to exclude events that have a blank System Name field. I was trying to do it thusly:

search | where isnull(System Name)

Is that wrong?

Thanks,

Tags (4)
1 Solution

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

View solution in original post

gsopkoTC
Path Finder

I know this is a bit late, but possibly:

field!=null

lguinn2
Legend

null is not a reserved word in Splunk. So your solution may appear to work, but it is actually testing

field!="null"

In the search command, the text following an equal sign is considered a string.

But it probably works in your application.

0 Karma

dcagatay
Explorer

In my case, field search with asterisk(*) didn't work, but using not equal to empty string worked.

fieldA!=""

jakeblack
Explorer

This sorted me right out! Thanks

0 Karma

lguinn2
Legend

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

lbogle
Contributor

There are supposed to be asterix marks after the ='s above....

0 Karma

lbogle
Contributor

I see. So if you have fieldA=* it will only return events with fieldA=* where fieldA actually has "anything" in and not "nothing" or blank space. Is that correct?

Would the correct syntax for the way I put it first be?:

search | where isnotnull(hostname)

Thanks for your time!

0 Karma

lguinn2
Legend

Yes, fieldA=* means "fieldA must have a value." Blank space is actually a valid value, hex 20 = ASCII space - but blank fields rarely occur in Splunk.

Yes, you can use isnotnull with the where command. But it is most efficient to filter in the very first search command if possible.

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...