Splunk Enterprise

How do I find a number of non-null values and put them in a column?

mistydennis
Communicator

I have a search that pulls values for 5 fields, some of which have a value and some that are null. I would like to create a new column ("totalrev") that counts the number of non-null values.

| inputlookup foo 
| search  field1=* OR field2=* OR field3=* OR field4=* OR field5=* 
| table field1, field2, field3, field4, field5, totalrev

How do I get a number into the "totalrev" column that will count the number of non-null values found in fields 1 - 5?

Tags (1)
0 Karma
1 Solution

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

View solution in original post

tomawest
Path Finder

I think you would get it using the following statement above your table

eval totalrev=mvcount(mvappend(field1,field2,field3,field4,field5))

mistydennis
Communicator

Yes! That's what I needed - thank you so much!

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...