How to exclude events with null fields in a search?

[lbogle]

Hello Splunkers,
I've got a search built thats working properly but I'm not able to get the events with a particular blank field excluded. In particular, I'm trying to exclude events that have a blank System Name field. I was trying to do it thusly:

search | where isnull(System Name)

Is that wrong?

Thanks,

[gsopkoTC]

I know this is a bit late, but possibly:

field!=null

[lguinn2]

null is not a reserved word in Splunk. So your solution may appear to work, but it is actually testing

field!="null"

In the search command, the text following an equal sign is considered a string.

But it probably works in your application.

[dcagatay]

In my case, field search with asterisk(*) didn't work, but using not equal to empty string worked.

fieldA!=""

[jakeblack]

This sorted me right out! Thanks

[lguinn2 · Accepted solution]

That's not the easiest way to do it, and you have the test reversed. Plus, field names can't have spaces in the search command. Here is the easy way:

fieldA=*

This search will only return events that have some value for fieldA. If you want to make sure that several fields have values, you could do this

fieldA=* SystemName=*

[lbogle]

There are supposed to be asterix marks after the ='s above....

[lbogle]

I see. So if you have fieldA=* it will only return events with fieldA=* where fieldA actually has "anything" in and not "nothing" or blank space. Is that correct?

Would the correct syntax for the way I put it first be?:

search | where isnotnull(hostname)

Thanks for your time!

[lguinn2]

Yes, fieldA=* means "fieldA must have a value." Blank space is actually a valid value, hex 20 = ASCII space - but blank fields rarely occur in Splunk.

Yes, you can use isnotnull with the where command. But it is most efficient to filter in the very first search command if possible.