is there a way to find if a field itself is not being sent

[xvxt006]

Hi,

we have a cookie that we pass in the web logs. Sometimes some of the requests are not sending the cookie itself. Is there a way to find this using splunk?

[jtrucks]

Is there a field like cookie= available? if so, look for "cookie=*" to get all answers with "cookie=" in the event. Then you can check " ...| eval isnull(cookie)" to see what entries have nothing set for cookie.

Also read:

http://splunk-base.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

If there is NOT a field defined in such a way, you will have to do " ... NOT cookie=*" in order to negate the entries that already contain data in the extracted cookie field.

[xvxt006]

Thank you. One question, even though we don't see the key in the logs (we only see the values), should i be able to search by key=* . Also another question is, say the cookie name is xxx but if we extract and named it as yyy. So should i search by xxx=* or yyy=*?