Splunk Search

not getting empty row value count when doing count by fields.

satishachary199
New Member

i have four filed in a csv file, where some time , one filed value coming as empty, as like below
field1 , field2, field3, field4
DBW DCAR XTY XXS
DBW DCAR XTY XXF
LG DPORT XXS
LG DPORT XTY XXF

Like ,above data when i am doing "count by field1,field2,field3,field4 " not getting the count of empty value.

Thanks in Advance

Tags (1)
0 Karma

Williammbrooks
New Member

We can specify columns we want to calculate in two ways:
COUNT(*) will count all rows in all the columns. The result will be taken from the column that has the highest result.
COUNT(FIELD_NAME) that will calculate the row for a particular field (column).
Furthermore, we can use the COUNT function with or without the DISTINCT clause:
COUNT to count all the rows even if there are duplications of data.
COUNT( DISTINCT ...) to calculate unique rows (rows with same values will not be counted). You can visit my site for more details.

0 Karma

somesoni2
Revered Legend

If any of the field used in by clause of stats command is null, the whole row is dropped. What type of stats you want to do? I believe you'd need to use fillnull before stats to replace null value with some string e.g. N/A, and then do the stats so that you'd get count for all combinations.

0 Karma

satishachary199
New Member

thank you , followed the same , got solution.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...