Splunk Search

how to count rows with lack of field !

Explorer

so i have a log which has column/field which will be populated with "Y" if there is an ERROR, feild name is ERROR_FLAG and will be blank if there is no ERROR.

how do i calculate rows where this FIELD is non-existant or blank ?

alternatively, how do i subtract ERROR_FEILD="Y" Count from Total Row count to get me this data.. all has to be done in real time.

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

Calculating non-existent or blank can be done like this:

... NOT ERROR_FLAG=*

To count the rows where the field is not Y, including blank or missing:

... NOT ERROR_FLAG="Y" | stats count

NOTE: Using "<field>!=<value>" will not account for missing or empty fields. You should use the "NOT <field>=<value>" syntax.

View solution in original post

Splunk Employee
Splunk Employee

Calculating non-existent or blank can be done like this:

... NOT ERROR_FLAG=*

To count the rows where the field is not Y, including blank or missing:

... NOT ERROR_FLAG="Y" | stats count

NOTE: Using "<field>!=<value>" will not account for missing or empty fields. You should use the "NOT <field>=<value>" syntax.

View solution in original post

Splunk Employee
Splunk Employee

Not-Exist OR blank is a bit tricky. Try

(ERROR="" OR NOT ERROR="*")
0 Karma

Splunk Employee
Splunk Employee

Oh, Ayn's solution is superior if it is really precisely as you describe.

0 Karma

Legend

I think it will be easier to answer your question if you can provide us with some sample events. Once you have a working field extraction, the rest should pose no problems. If you've successfully extracted the field using name "error_field" for instance, you would just have to do

error_field!="Y"

I'm unsure what you mean by that it has to be done in real time. The field extractions will work on any search, regardless of what time range you choose (including real-time).

Legend

I stand corrected. Thanks!

0 Karma

Splunk Employee
Splunk Employee

This method will not account for blank values or a missing field. See my answer to account for these.

0 Karma