Splunk Search

How to exclude null values in mv fields?

karthi2809
Builder

In my mv field nameas  errortype.In the error type the counts shows file not found as 4 and empty as 2 .I want to exclude the empty values from the mv fields

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are these multivalue fields within the same event?

By "empty" do you mean they contain the word "empty" or that they have no value (empty string) or that they don't exist?

Please share some sample (anonymised) events to illustrate what you mean.

0 Karma

karthi2809
Builder

Its empty in the field .Attached screenshot. For some of the transaction we have multiple error type with empty values and with values.

For the same transaction below events are there with empty and with value.

"timestamp" : "2024-03-21T17:33:53.993Z", "content" : { "ErrorType" : "", "ErrorMsg" : "" }

"timestamp" : "2024-03-21T17:33:20.786Z", "content" : { "ErrorType" : "HTTP:NOT_FOUND", "ErrorMsg" : "HTTP /glimport' failed: not found (404)." },
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where ErrorType != ""
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...