Splunk Search

How to get all instances that has a field without any value

manjushan
Explorer

This is the line in my log file.I want to get all searchTerms that do not have a value for PAMapped

2012-10-29 11:20:21,711 - searchTerm=speeding&location=Soperton%2C+GA&PAMapped=

This is the search I gave.

index=savvis-varnish host="dell1000a-12" source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" NOT PAMapped=* earliest=-1mon@mon

But it does not return all instances. It returns only one.

0 Karma

manjushan
Explorer

I could use eval to map it to a variable is the value is null

index=savvis-varnish source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" earliest=-0mon@mon| eval Practice_Area=if(isnull(PAMapped),"Not Mapped",urldecode(PAMapped))

But now how do I use eval to display only those log lines that have Practice_Area="Not Mapped"

0 Karma

manjushan
Explorer

Tried, No result.

0 Karma

manjushan
Explorer

Tried, No result. I saw that there is isnull function with eval ? Do you know how to use that.

0 Karma

BobM
Builder

Try this with no spaces

PAMapped=""
0 Karma

manjushan
Explorer

Tried this too, with no result:

index=savvis-varnish host="dell1000a-12" source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" PAMapped='' earliest=-1mon@mon

0 Karma

manjushan
Explorer

I tried

index=savvis-varnish host="dell1000a-12" source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" PAMapped!=* earliest=-1mon@mon

but did not return any result.

0 Karma

mattness
Splunk Employee
Splunk Employee

Try this search instead:

index=savvis-varnish host="dell1000a-12" source="/flocal/logs/lawyers.findlaw.com/search-mapping.log" PAMapped!=* earliest=-1mon@mon

The != operator can be better for this sort of thing.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...