Splunk Search

How to search for fields with empty values?

snemiro_514
Path Finder

I'm trying unsuccessfully to select events with fields with empty values.

How can this be accomplished?

My events:

....|responseCode=F10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=No Error|
....|responseCode=G10|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|
....|responseCode=G12|responseDesc=Invalid|status=SUCCESS|errorCode=0|errorDesc=|

So I need to search the events with errorDesc='empty', like the last 2 events.

I tried the basic stuff, but no luck. Also len(errorDesc) doesn't consider the events.

I will appreciate any help/guidance.

Tags (3)
1 Solution

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

View solution in original post

ppablo
Retired

Hi @snemiro_514

Have you tried a solution similar to this post?
http://answers.splunk.com/answers/28197/how-do-i-search-for-event-with-null-values-in-fields

So try:

your search... NOT errorDesc="*"

ppablo
Retired

No problemo @snemiro_514 At first I was thinking of the fillnull command too, but I figured there was definitely an easier method. Searched through some Answers posts and found it 🙂

0 Karma

snemiro_514
Path Finder

Hi, yep!...that worked. I also have found a workaround...

index ... | fillnull value="XXX" responseDesc | search responseDesc="XXX"

Gracias!

0 Karma

edgars
Explorer

Thanks for fillnull and search commands!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...