Splunk Search

stats command to get count of NULL values

Communicator

I am using a DB query to get stats count of some data from 'ISSUE' column. This column also has a lot of entries which has no value in it.

something like,

ISSUE

Event log alert

Skipped count

how do i get the NULL value (which is in between the two entries also as part of the stats count. Is there any way?

Tags (1)
1 Solution

Super Champion

In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search issue="*" | fillnull value=null issue | stats count by issue

View solution in original post

Super Champion

In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

search issue="*" | fillnull value=null issue | stats count by issue

View solution in original post

Communicator

awesome, that fixed it 🙂 thanks a lot.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!