Splunk Search

URGENT REQUEST: how to pull specific values from given query?

iqbalintouch
Path Finder

sourcetype=abc "responseStatus=500" "abc.xyz.logging.yyyy.zzzzz" "cccccccccccccc88888883333hhhh" | rex field=_raw "\"customerBilledAmount\" : (?.?)," | rex field=_raw "\"resultID\" : (?.?)," | rex field=_raw "\"customerID\" : (?.*?)," | dedup resultID | table userrBilledAmount resultID customerID

Now I need to achieve
- exclude all null
- add up all userBilledAmount
- exclude all null from userBilledAmount only

0 Karma
1 Solution

493669
Super Champion

Hi @iqbalintouch, try below-

...|where isnotnull(userrBilledAmount)

This will remove null value field.
then you can use stats to add them like |stats sum(userrBilledAmount) as TotalAmount by customerID

View solution in original post

0 Karma

iqbalintouch
Path Finder

if I need to pull the data where userBilledAmount !=0.0 ??

how to achieve..your query has given near to desired output..

0 Karma

493669
Super Champion

Hi @iqbalintouch, try below-

...|where isnotnull(userrBilledAmount)

This will remove null value field.
then you can use stats to add them like |stats sum(userrBilledAmount) as TotalAmount by customerID

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...