Splunk Search

is "-" equals to Null

xvxt006
Contributor

Hi,

In another thread i have asked about if there is a way to identify if a particular cookie not being sent at all in the request. i got the below answer.

Is there a field like cookie= available? if so, look for "cookie=*" to get all answers with "cookie=" in the event. Then you can check " ...| eval isnull(cookie)" to see what entries have nothing set for cookie.

we ran a test to see how splunk displays when we don't send a cookie at all. We sent three HTTP requests, (1) Cookie=WEB (2) Cookie= (3) no Cookie. For #2 and #3 both of these result in the same result of "-".

So how do we find if the cookie is not sent or if the cookie is sent but no value in splunk.

Tags (1)
0 Karma
1 Solution

lukejadamec
Super Champion

The "-" is inserted by web logger as a place holder when there is no value.
Splunk puts the "-" in the field because that is what is in the log. Splunk will have no way of differentiating between cookie=null and no cookie.

View solution in original post

lukejadamec
Super Champion

The "-" is inserted by web logger as a place holder when there is no value.
Splunk puts the "-" in the field because that is what is in the log. Splunk will have no way of differentiating between cookie=null and no cookie.

xvxt006
Contributor

Thank you.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...