Splunk Search

eval isnull() always returns true

dmrhodes101
Explorer

We're using Splunk to monitor EDI traffic onto our backend system. We want to have a single value panel that shows green when an order has been received, yellow, when there's been no order and it's prior to 16:00 and red when there's been no order and it's 16:00+

Here's the command I used, but the isnull always returns 0 even when EDI-count is greater than 0.

source="C:\\Monitor\\Vista\\EDI\\EDISPLUNK.csv" NOT _raw="Date,Time,Type,Account,Name,Order Qty,EAN,SAN,Order Ref,Order Date,From1,From2" host="Vista-EDI2" AND Name="Companyname*" 
| stats count as EDI-count
| eval Time=now()
| convert timeformat=%H:%M ctime(Time)
| eval Got=if(isnull(EDI-count),0,1)
| eval Test=case(Got=0 and Time>="16:00",0,Got=0 and Time<"16:00",2,Got=1,4)
| rangemap field=Test low=4-5 elevated=2-3 default=severe
Tags (1)

sowings
Splunk Employee
Splunk Employee

I think that stats will give you a 0 for the count if there are no matching events, not null. Zero isn't null.

It also appears that Splunk may be interpreting the field name "EDI-count" as a subtraction of two undefined fields EDI and count. I had to remove the - (or change it to an underscore) to make it work in my testing.

The EDI_count field is effectively acting as a boolean already, but if you want to normalize it to (0|1), your eval call would look like:
eval Got=if(EDI_count,1,0), or eval Got=if(EDI_count==0,0,1) if you're the explicit type.

Note also that you can save a step with your Time field and do eval Time=strftime(now(), "%H:%M").

dmrhodes101
Explorer

That's perfect thanks.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...