Splunk Search

How to exclude null values in mv fields?

karthi2809
Builder

In my mv field nameas  errortype.In the error type the counts shows file not found as 4 and empty as 2 .I want to exclude the empty values from the mv fields

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these multivalue fields within the same event?

By "empty" do you mean they contain the word "empty" or that they have no value (empty string) or that they don't exist?

Please share some sample (anonymised) events to illustrate what you mean.

0 Karma

karthi2809
Builder

Its empty in the field .Attached screenshot. For some of the transaction we have multiple error type with empty values and with values.

For the same transaction below events are there with empty and with value.

"timestamp" : "2024-03-21T17:33:53.993Z", "content" : { "ErrorType" : "", "ErrorMsg" : "" }

"timestamp" : "2024-03-21T17:33:20.786Z", "content" : { "ErrorType" : "HTTP:NOT_FOUND", "ErrorMsg" : "HTTP /glimport' failed: not found (404)." },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""
0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...