Splunk Search

How to exclude null field values from search results?

ibob0304
Communicator

Below are the log events I have, where one event has two savedsearch_name fields with two values "Apache_Monitor" and other is "" empty.
And other event has only one savedsearch_name

Audit:[timestamp=xx-xx-xxxx xx:xx:xx.xxx, id=xxxxx, user=admin, action=search, info=granted , search_id='xxxxxxxx',  index=summary `savedsearch_name`="Apache_Monitor"', enable_lookups='1', extra_fields='*', `savedsearch_name`=""]

Audit:[timestamp=xx-xx-xxxx xx:xx:xx.xxx, id=xxxxx, user=admin, action=search, info=granted , search_id='xxxxxxxx',  index=summary `savedsearch_name`="Apache_Monitor"']

I want to look only for one field one value (2nd event). So I tried to use NOT condition to get rid of two same field events (1st event)

index=_audit action="search" (savedsearch_name="Apache_Monitor") NOT (savedsearch_name="")  search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY"

But It doesn't work, How to exclude the events which has no value ?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

index=_audit action="search" (savedsearch_name="Apache_Monitor") NOT ("savedsearch_name*savedsearch_name")  search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY"

Updated

index=_audit action="search" (savedsearch_name="Apache_Monitor")  search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY" | rex max_match=2 "(?<noOfSavedSearch>savedsearch_name)" | where mvcount(noOfSavedSearch)=1

View solution in original post

msivill_splunk
Splunk Employee
Splunk Employee

So the following will work and/or provide pointers how to do this.

index="462049" 
| rex field=_raw ".*`savedsearch_name`.*`savedsearch_name`=\"(?<savedsearch_name_second>)\".*" 
| eval savedsearch_name_second_is_blank=if(savedsearch_name_second="",1,0) 
| where savedsearch_name_second_is_blank = 0

So the trick is to use regex to find a second savedsearch_name by looking directly against the _raw event field. Then apply additional logic against this field.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

index=_audit action="search" (savedsearch_name="Apache_Monitor") NOT ("savedsearch_name*savedsearch_name")  search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY"

Updated

index=_audit action="search" (savedsearch_name="Apache_Monitor")  search=* NOT "typeahead" NOT metadata NOT "|history" NOT "AUTOSUMMARY" | rex max_match=2 "(?<noOfSavedSearch>savedsearch_name)" | where mvcount(noOfSavedSearch)=1

ibob0304
Communicator

Still I am seeing two same fields in one event. Is it not possible to eliminate the events which has two same field ?

0 Karma

ibob0304
Communicator

Updated one works perfectly, you successfully removed the two same field events. thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give the updated answer a try.

0 Karma

msivill_splunk
Splunk Employee
Splunk Employee

So a few further questions for clarification -

  • Can savedsearch_name appear more than twice?
  • Can both savedsearch_names be empty?
  • Are the only events you want exclude are match on first and nothing on second? ( So nothing on first and match on second is allowed )
0 Karma

ibob0304
Communicator
  • no
  • no
  • yes
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...