Splunk Search

Why is ISNULL functionality not working?

Keerthi
Path Finder

Keerthi_0-1681721858028.png

I am trying to get the data only when my lastlogon(field name) is Null. but the above query is still giving me data for both Null and non Null values.

Labels (1)
0 Karma

woodcock
Esteemed Legend

Fields are case sensitive and also sometimes "empty" (i.e. == "").  You can check for both like this:

(isnull(LASTLOGON) OR LASTLOGON=="")

ITWhisperer
SplunkTrust
SplunkTrust

Field name are case-sensitive - try this

| where isnull(LASTLOGON)
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...