Splunk Search

search: case --> field doesn't exist

LauraBre
Communicator

hello,

I have a question about a search with case. This is my search:

source="Laura_acs" |eval Transac=case(ERRL="TIMEOUT_REACHED" OR ERRL="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND  (NOT ERRL="TIMEOUT_REACHED" OR NOT ERRL="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="N","VE No",STAT_VE="Y" AND SD_STAT_PA="Y","PA Yes",STAT_VE="Y" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="Y" AND SD_STAT_PA="N", "PA No",STAT_VE="Y","VE sans PA")|DEDUP ID_TRANS|chart count by Transac 

In this search I want for the last case (VE sans PA) that my log line doen't contain field SD_STAT_PA. How can do it? Because, for the moment, STAT_VE="Y" is the selection of all the others case.

Thx by advance,

Laura

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Use isnull:

isnull(SD_STAT_PA)

View solution in original post

Ayn
Legend

Use isnull:

isnull(SD_STAT_PA)

LauraBre
Communicator

Thx very much, it works.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...