Splunk Search

Seprating null and empty fields


Hi All,

I have multiple cases with my date:
some have empty src value: e.g,
id=abc src= lr=2
some does not have src at all: e.g.,
id=cde lr=5
and the rest have src with values: e.g.,
id=rty src=df lr=5

The question is how can I separate these three cases? I tried isnull(src) but it does not work.


Tags (3)
0 Karma

Super Champion


search | fillnull value=null | stats count by id, src, lr

fillnull will fill empty values even when the field does not exist.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!