Splunk Search

How to search for fields with empty values?

snemiro_514
Path Finder

I'm trying unsuccessfully to select events with fields with empty values.

How can this be accomplished?

My events:

....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|
....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|
....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|

So I need to search the events with errorDesc='empty', like the last 2 events.

I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.

I will appreciate any help/guidance.

Tags (3)
1 Solution

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

View solution in original post

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

ppablo
Retired

No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it 🙂

0 Karma

snemiro_514
Path Finder

Hi, yep!...that worked. I also have found a workaround...

index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"

Gracias!

0 Karma

edgars
Explorer

Thanks for fillnull and search commands!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...