Splunk Search

Missing field detection

sranga
Path Finder

Hi

I was wondering if there was a way to search for logs that don't have a specific field in them.
If I have the following log file:

id=112233,type=a,message=b,name=ewr,status=404  
id=2233,type=b,message=b,name=rrr  
id=434343,type=c,message=b,name=ooo,status=200  
id=6556,type=d,message=b,name=ppp  

How do I get lines 2 & 4 in my search (since they don't have the status field)?
Thanks for your help.

Ranga

0 Karma
1 Solution

Lowell
Super Champion

You want to use the search expression:

NOT status="*"

Keep in mind that this is not equivalent to:

status!="*"

I recommend looking at this related question for additional explanation on this: How can I search for a missing field?


I should also point out that if the word "status" is part of the event (as shown in your example), then you could simply search like this:

NOT status

Which could be faster since "status" would be a term in the index, which is a faster operation than comparing an extracted field. (Although, with a small number of events you may not notice the difference.)

View solution in original post

Lowell
Super Champion

You want to use the search expression:

NOT status="*"

Keep in mind that this is not equivalent to:

status!="*"

I recommend looking at this related question for additional explanation on this: How can I search for a missing field?


I should also point out that if the word "status" is part of the event (as shown in your example), then you could simply search like this:

NOT status

Which could be faster since "status" would be a term in the index, which is a faster operation than comparing an extracted field. (Although, with a small number of events you may not notice the difference.)

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...