Splunk Search

What is null values? in a simple way

mkhedr
Explorer

can anyone explain what is null values returned from the search? As simple as possible

Tags (1)
0 Karma

woodcock
Esteemed Legend

It is the total lack of any value, which is different from a blank (0-length) empty value. These are non-null values:

| makeresults | eval non-null_empty="", non-null_space = " ", non-null_letter = "1" | foreach non* [ eval <<FIELD>>_len = len('<<FIELD>>') ] | table *null*

This are nulls (they do not exist at all):

| makeresults | eval now_null=null() | eval now_null_len=len(now_null), always_null_len=len(always_null) | table now_null now_null_len always_null always_null_len

@mkhedr community would be able to assist you further if you provide more context to what are you trying to see and where you see NULL value.

NULL value represents and event row where specific field being queried is not present. There are several scenarios this may happen:

Scenario 1
If it is with reference to timechart and you have timechart split by a specific field lets say field1 and you see the NULL series that would be because you have filtered events where field1 does not exist.

Usually, adding field1="*" to your main search query while pulling data from index solves this.
Scenario 2
If you have some calculations/evaluations which do not apply to all the rows selected then it will generate fields with NULL values. For example, if field1 below has three or more values, then myfield will have NULL values foe each event where field1 is not alpha or beta

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B")

Adding a default case using 1==1 or true() condition usually fixes this by providing the default value. For example:

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B",
                                    true(),"unknown")

These are just couple of scenarios, but there may be several other situations where you can have NULL value in your data like referring to field at particular pipe in SPL where it may not exist. So requesting you to provide more context to your question for us to assist with your exact question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...