Splunk Search

How to exclude null values in mv fields?

karthi2809
Builder

In my mv field nameas  errortype.In the error type the counts shows file not found as 4 and empty as 2 .I want to exclude the empty values from the mv fields

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these multivalue fields within the same event?

By "empty" do you mean they contain the word "empty" or that they have no value (empty string) or that they don't exist?

Please share some sample (anonymised) events to illustrate what you mean.

0 Karma

karthi2809
Builder

Its empty in the field .Attached screenshot. For some of the transaction we have multiple error type with empty values and with values.

For the same transaction below events are there with empty and with value.

"timestamp" : "2024-03-21T17:33:53.993Z", "content" : { "ErrorType" : "", "ErrorMsg" : "" }

"timestamp" : "2024-03-21T17:33:20.786Z", "content" : { "ErrorType" : "HTTP:NOT_FOUND", "ErrorMsg" : "HTTP /glimport' failed: not found (404)." },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...