Splunk Search

stats command to get count of NULL values

anoopambli
Communicator

I am using a DB query to get stats count of some data from 'ISSUE' column. This column also has a lot of entries which has no value in it.

something like,

ISSUE

Event log alert

Skipped count

how do i get the NULL value (which is in between the two entries also as part of the stats count. Is there any way?

Tags (1)
1 Solution

lukejadamec
Super Champion

In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search issue="*" | fillnull value=null issue | stats count by issue

View solution in original post

JChapp23
Loves-to-Learn Lots

Is there a way to rename the NULL to display something else?

 

0 Karma

lukejadamec
Super Champion

In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search issue="*" | fillnull value=null issue | stats count by issue

anoopambli
Communicator

awesome, that fixed it 🙂 thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...