Splunk Search

What is null values? in a simple way

mkhedr
Explorer

can anyone explain what is null values returned from the search? As simple as possible

Tags (1)
0 Karma

woodcock
Esteemed Legend

It is the total lack of any value, which is different from a blank (0-length) empty value. These are non-null values:

| makeresults | eval non-null_empty="", non-null_space = " ", non-null_letter = "1" | foreach non* [ eval <<FIELD>>_len = len('<<FIELD>>') ] | table *null*

This are nulls (they do not exist at all):

| makeresults | eval now_null=null() | eval now_null_len=len(now_null), always_null_len=len(always_null) | table now_null now_null_len always_null always_null_len

niketn
Legend

@mkhedr community would be able to assist you further if you provide more context to what are you trying to see and where you see NULL value.

NULL value represents and event row where specific field being queried is not present. There are several scenarios this may happen:

Scenario 1
If it is with reference to timechart and you have timechart split by a specific field lets say field1 and you see the NULL series that would be because you have filtered events where field1 does not exist.

Usually, adding field1="*" to your main search query while pulling data from index solves this.
Scenario 2
If you have some calculations/evaluations which do not apply to all the rows selected then it will generate fields with NULL values. For example, if field1 below has three or more values, then myfield will have NULL values foe each event where field1 is not alpha or beta

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B")

Adding a default case using 1==1 or true() condition usually fixes this by providing the default value. For example:

| eval myfield=case(field1=="alpha","A",
                                    field1=="beta","B",
                                    true(),"unknown")

These are just couple of scenarios, but there may be several other situations where you can have NULL value in your data like referring to field at particular pipe in SPL where it may not exist. So requesting you to provide more context to your question for us to assist with your exact question.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...