Splunk Search

Search results include fields with no values, can this be done?

DanielFordWA
Contributor

Is it possible to get search results in a table when only some of the results will have all the fields associated with them?

Currently I cannot get this to work.

For example....

DateTimeUserURLTermProduct
15/05/201310:01:02User123456/Home/--
15/05/201310:01:32User123456/Products/--
15/05/201310:01:53User123456/Products/Product1/-ID12345678
15/05/201310:02:42User123456/Search/--
15/05/201310:03:12User123456/Search/Results/Car-
0 Karma
1 Solution

Ayn
Legend

fillnull?

... | fillnull value="-" Term Product | ...

View solution in original post

wpreston
Motivator

I usually use eval to handle these. Something like:

...my search params... | eval TermProduct=if(isnull(TermProduct),"None",TermProduct) | ...other search params...

then adjust your search to account for "None" (or whatever you want to eval it to) in that field.

Ayn
Legend

fillnull?

... | fillnull value="-" Term Product | ...

Ayn
Legend

You need fillnull before your stats command, not after.

0 Karma

DanielFordWA
Contributor

If in my search query I use the below...

stats count by Date Time User URL Term | Fields Date Time User URL Term | fillnull value="-" Term

This will only return the last result on the above table. The previous 4 results do not have the field "Term" associated with them, however I would like these to populate with a blank if that is the case.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...