Splunk Search

Only show null values from timechart values(source)

splunkreal
Motivator

Hello guys,

could you tell me how to only show null cells from this kind of table, for alerting purpose?

Search: index=* host=XXX source=/var/log* | eval ... | timechart span=1d values(source) by host

alt text

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

somesoni2
Revered Legend

I would setup alert based on this search

index= host=XXX source=/var/log | eval ... | timechart span=1d values(source) by host 
| eval shouldAlert=0 | foreach * [eval shouldAlert=shouldAlert+if(isnull('<<FIELD>>') OR '<<FIELD>>'="",1,0) ]
| where shouldAlert>0

Basically it'll loop through all columns for a row and add 1 to shouldAlert field if there are null value in that rows. Later we only select rows where alert should be raised. You can then setup alert with condition 'if number of events greater than 0'

View solution in original post

woodcock
Esteemed Legend

Just add this to the end:

| eval NULLVALUE="NO"
| foreach * [eval NULLVALUE=if(isnull(<<FIELD>>), "YES", NULLVALUE)]
| search NULLVALUE="YES"

splunkreal
Motivator

No result... I tried src, host or even source for <>

* If this helps, please upvote or accept solution if it solved *
0 Karma

woodcock
Esteemed Legend

No, you do not need to change ANYTHING. Type it in EXACTLY as I had it and it will work.

somesoni2
Revered Legend

I would setup alert based on this search

index= host=XXX source=/var/log | eval ... | timechart span=1d values(source) by host 
| eval shouldAlert=0 | foreach * [eval shouldAlert=shouldAlert+if(isnull('<<FIELD>>') OR '<<FIELD>>'="",1,0) ]
| where shouldAlert>0

Basically it'll loop through all columns for a row and add 1 to shouldAlert field if there are null value in that rows. Later we only select rows where alert should be raised. You can then setup alert with condition 'if number of events greater than 0'

splunkreal
Motivator

Same, no result... I tried src, host or even source for <>

* If this helps, please upvote or accept solution if it solved *
0 Karma

somesoni2
Revered Legend

YOu need to use literally '<>' there. No need to replace it with any field names.

splunkreal
Motivator

Thanks a lot!

* If this helps, please upvote or accept solution if it solved *
0 Karma

DalJeanis
Legend
| where isnull(myfieldname)
0 Karma

splunkreal
Motivator

It doesn't work, I tried values(source) as src then use | where isnull(src) but nothing changed...

| where isnull(values(source)) = 'values' function is unsupported

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...