Splunk Search

Writing a regular expression to capture null values

mahbs
Path Finder

Hi,

I've got fields which contain null values. I'm writing a regular expression to capture instances where fields contain null values.

This is what I have, but it's not working.
^(^.){0}$
I'm trying to say in this expression, looking something that's empty. But as mentioned before, it's not working. I'm not too sure how null works in splunk.

Could someone please help me with this?

Thanks
Mahbs

Tags (1)
0 Karma

micahkemp
Champion

Do you want to find events like:

fieldyoucareabout= otherfield1=value1 otherfield2=value2

Or instead:

otherfield1=value1 otherfield2=value2

0 Karma

elliotproebstel
Champion

Have you tried using your base search | where isnull(fieldname) syntax rather than regular expressions? You can use this to find events with null values for any number of fields by chaining them like this: your base search | where isnull(fieldname) OR isnull(field2name)...

0 Karma

niketn
Legend

@mahbs, can you add sample events and also your current code using the code button (101010) on Splunk Answers, so that special characters do not escape?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...