Splunk Search

Search results include fields with no values, can this be done?

DanielFordWA
Contributor

Is it possible to get search results in a table when only some of the results will have all the fields associated with them?

Currently I cannot get this to work.

For example....

DateTimeUserURLTermProduct
15/05/201310:01:02User123456/Home/--
15/05/201310:01:32User123456/Products/--
15/05/201310:01:53User123456/Products/Product1/-ID12345678
15/05/201310:02:42User123456/Search/--
15/05/201310:03:12User123456/Search/Results/Car-
0 Karma
1 Solution

Ayn
Legend

fillnull?

... | fillnull value="-" Term Product | ...

View solution in original post

wpreston
Motivator

I usually use eval to handle these. Something like:

...my search params... | eval TermProduct=if(isnull(TermProduct),"None",TermProduct) | ...other search params...

then adjust your search to account for "None" (or whatever you want to eval it to) in that field.

Ayn
Legend

fillnull?

... | fillnull value="-" Term Product | ...

Ayn
Legend

You need fillnull before your stats command, not after.

0 Karma

DanielFordWA
Contributor

If in my search query I use the below...

stats count by Date Time User URL Term | Fields Date Time User URL Term | fillnull value="-" Term

This will only return the last result on the above table. The previous 4 results do not have the field "Term" associated with them, however I would like these to populate with a blank if that is the case.

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...