Splunk Search

How to search for fields with empty values?

snemiro_514
Path Finder

I'm trying unsuccessfully to select events with fields with empty values.

How can this be accomplished?

My events:

....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|
....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|
....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|

So I need to search the events with errorDesc='empty', like the last 2 events.

I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.

I will appreciate any help/guidance.

Tags (3)
1 Solution

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

View solution in original post

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

ppablo
Retired

No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it 🙂

0 Karma

snemiro_514
Path Finder

Hi, yep!...that worked. I also have found a workaround...

index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"

Gracias!

0 Karma

edgars
Explorer

Thanks for fillnull and search commands!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...