Splunk Search

Only show null values from timechart values(source)

splunkreal
Motivator

Hello guys,

could you tell me how to only show null cells from this kind of table, for alerting purpose?

Search: index=* host=XXX source=/var/log* | eval ... | timechart span=1d values(source) by host

alt text

Thanks.

* If this helps, please upvote or accept solution if it solved *
0 Karma
1 Solution

somesoni2
Revered Legend

I would setup alert based on this search

index= host=XXX source=/var/log | eval ... | timechart span=1d values(source) by host 
| eval shouldAlert=0 | foreach * [eval shouldAlert=shouldAlert+if(isnull('<<FIELD>>') OR '<<FIELD>>'="",1,0) ]
| where shouldAlert>0

Basically it'll loop through all columns for a row and add 1 to shouldAlert field if there are null value in that rows. Later we only select rows where alert should be raised. You can then setup alert with condition 'if number of events greater than 0'

View solution in original post

woodcock
Esteemed Legend

Just add this to the end:

| eval NULLVALUE="NO"
| foreach * [eval NULLVALUE=if(isnull(<<FIELD>>), "YES", NULLVALUE)]
| search NULLVALUE="YES"

splunkreal
Motivator

No result... I tried src, host or even source for <>

* If this helps, please upvote or accept solution if it solved *
0 Karma

woodcock
Esteemed Legend

No, you do not need to change ANYTHING. Type it in EXACTLY as I had it and it will work.

somesoni2
Revered Legend

I would setup alert based on this search

index= host=XXX source=/var/log | eval ... | timechart span=1d values(source) by host 
| eval shouldAlert=0 | foreach * [eval shouldAlert=shouldAlert+if(isnull('<<FIELD>>') OR '<<FIELD>>'="",1,0) ]
| where shouldAlert>0

Basically it'll loop through all columns for a row and add 1 to shouldAlert field if there are null value in that rows. Later we only select rows where alert should be raised. You can then setup alert with condition 'if number of events greater than 0'

splunkreal
Motivator

Same, no result... I tried src, host or even source for <>

* If this helps, please upvote or accept solution if it solved *
0 Karma

somesoni2
Revered Legend

YOu need to use literally '<>' there. No need to replace it with any field names.

splunkreal
Motivator

Thanks a lot!

* If this helps, please upvote or accept solution if it solved *
0 Karma

DalJeanis
Legend
| where isnull(myfieldname)
0 Karma

splunkreal
Motivator

It doesn't work, I tried values(source) as src then use | where isnull(src) but nothing changed...

| where isnull(values(source)) = 'values' function is unsupported

* If this helps, please upvote or accept solution if it solved *
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...