I've got fields which contain null values. I'm writing a regular expression to capture instances where fields contain null values.
This is what I have, but it's not working.
I'm trying to say in this expression, looking something that's empty. But as mentioned before, it's not working. I'm not too sure how null works in splunk.
Have you tried using your base search | where isnull(fieldname) syntax rather than regular expressions? You can use this to find events with null values for any number of fields by chaining them like this: your base search | where isnull(fieldname) OR isnull(field2name)...