Splunk Search

How to search for fields with empty values?

snemiro_514
Path Finder

I'm trying unsuccessfully to select events with fields with empty values.

How can this be accomplished?

My events:

....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|
....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|
....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|

So I need to search the events with errorDesc='empty', like the last 2 events.

I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.

I will appreciate any help/guidance.

Tags (3)
1 Solution

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

View solution in original post

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

ppablo
Retired

No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it 🙂

0 Karma

snemiro_514
Path Finder

Hi, yep!...that worked. I also have found a workaround...

index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"

Gracias!

0 Karma

edgars
Explorer

Thanks for fillnull and search commands!

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...