How to search for fields with empty values?

[snemiro_514]

I'm trying unsuccessfully to select events with fields with empty values.

How can this be accomplished?

My events:

....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|
....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|
....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|

So I need to search the events with errorDesc='empty', like the last 2 events.

I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.

I will appreciate any help/guidance.

[ppablo · Accepted solution]

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

[ppablo]

No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it 🙂

[snemiro_514]

Hi, yep!...that worked. I also have found a workaround...

index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"

Gracias!

[edgars]

Thanks for fillnull and search commands!