Splunk Search

Events with null fields being discarded in results?

echojacques
Builder

Hello, in my search below, events with null fields are being discarded/excluded from the results. Specifically, any src_ip that doesn't have a region or a city gets excluded. Only src_ip's with complete geoip information (country & region & city) are included in the results. How can I modify this search so that I see all results including src_ip's with incomplete geoip information?

sourcetype="IPS" | geoip src_ip | stats sum(hit_count) as hits by src_ip country region city signature | table src_ip country region city signature hits | sort -hits | head 10

Thanks!

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

Try this

sourcetype="IPS" 
| geoip src_ip 
| fillnull value="Unknown" country region city signature
| stats sum(hit_count) as hits by src_ip country region city signature 
| sort -hits
| head 10

View solution in original post

lguinn2
Legend

Try this

sourcetype="IPS" 
| geoip src_ip 
| fillnull value="Unknown" country region city signature
| stats sum(hit_count) as hits by src_ip country region city signature 
| sort -hits
| head 10

echojacques
Builder

Thanks, this works perfectly! I really appreciate it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...