Splunk Search

search: case --> field doesn't exist

LauraBre
Communicator

hello,

I have a question about a search with case. This is my search:

source="Laura_acs" |eval Transac=case(ERRL="TIMEOUT_REACHED" OR ERRL="TIMEOUT_REACHED_RECORD","PA Pb fin de session 3D Secure", SD_STAT_PA="NO" AND  (NOT ERRL="TIMEOUT_REACHED" OR NOT ERRL="TIMEOUT_REACHED_RECORD"),"PA Pb Autres",STAT_VE="N","VE No",STAT_VE="Y" AND SD_STAT_PA="Y","PA Yes",STAT_VE="Y" AND SD_STAT_PA="ATTEMPT","PA Attempt",STAT_VE="Y" AND SD_STAT_PA="N", "PA No",STAT_VE="Y","VE sans PA")|DEDUP ID_TRANS|chart count by Transac 

In this search I want for the last case (VE sans PA) that my log line doen't contain field SD_STAT_PA. How can do it? Because, for the moment, STAT_VE="Y" is the selection of all the others case.

Thx by advance,

Laura

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Use isnull:

isnull(SD_STAT_PA)

View solution in original post

Ayn
Legend

Use isnull:

isnull(SD_STAT_PA)

LauraBre
Communicator

Thx very much, it works.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...