Splunk Search

How to force DBconnect to send fields with NULL values to the index?


DBconnect is not sending fields with NULL values to the index
Is there a way to force DBconnect to do this ?

0 Karma


I have used query as below in DBconnect
SELECT COALESCE(field1,'NULL') AS field1, field2 FROM "schema1"."table1"
and getting the desired results

0 Karma


Thank You Rich
The major problem is , most of the time, making changes to the DB side is near impossible !


0 Karma


The easiest way to fix this is on the DB side of things, not the Splunk side. If you handle null values there and convert them into just an empty string, they'll come across into Splunk fine.

So how to do that? Well, you don't mention which DBMS you are using so you'll have to look up your own, but most DBs have some variant of COALESCE which will just take fields or values until one is not null. So, ON THE QUERY side of things that SometimesNullField would be selected out using a SQL statement vaguely like this one...

select field1, field2, COALESCE(SometimesNullField, "") AS SomettimeNullFieldFixed, field4, .... FROM ....

Though another option would be to use that same sort of syntax (Whatever it is for your DBMS) to create a View, then have Splunk call the view instead of the raw table (this is also useful for abstracting complex queries into a simple and easy to read one that Splunk uses, and pushes Business logic into the DB layer).

Lastly, you could also get around this whole entire problem by not ever allowing null values in your database. Again, a problem that needs fixing on the DB side of things.

I hope these help!
appy Splunking,

Tags (3)
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...