Splunk Search

Search for null values across multiple fields

paulyreid
New Member

Hi

I have a CSV input file that has some null values. I'm using fillnull value=NULL to make these appear in the search results.

I'm able to search if a specified field is null, for example search x=null | stats count by x.

What I'd ideally like to do is return the name of any field that has a null value. Ideally something like search *=null | stats dc(*) as *. Then I can use transpose to get the list of those field names to display as table in a dashboard.

Cheers

Tags (3)
0 Karma

sideview
SplunkTrust
SplunkTrust

The problem is going to be that coming out of an AutoHeader or CHECK_FOR_HEADER csv input, there's no difference between a defined field that is null-valued, and a completely random field like "chickenfeet" that is entirely undefined.

There are some confusing things around fields that have empty values, but in my experience this only happens when you're doing certain things in the search language down in the later pipes.

Someone else might have a better suggestion but I think you'll have to have to do it explicitly with a big set of fullnulls, and a lot of | where isnull(A) OR isnull(B) OR ...

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...