Getting Data In

How can I properly index empty and blank space values in a multivalue field?

tcmarquesi
Explorer

Hi all.

Each event in my logfile are like instructions that log multiple actions at once. Then I made a transform to extract and build a multivalue field to index them (action, parm and ans). However, some of these fields can assume eventually empty "" or blank-space " " as values, for example:

tstamp="20151024 00:00:00.333"
port=port1
system=system1
mainkey=03CSDF39B539B5
action="w";parm="D058";ans="O"
action="A";parm="";ans="ERROR"
action="C";parm="A06F";ans=""
action="C";parm="D06E";ans=""

If I search mvcount(action) in the example, it returns 4, but mvcount(parm) returns 3. If I search mvindex(action,1), it returns "A", OK, but mvindex(parm,1), it returns A06F instead of "". Splunk didn't build the array properly.

So, what do I have to do to Splunk to accept empty and blank spaces as possible (and useful) values in order to solve this problem?

Thanks!

0 Karma

lguinn2
Legend

Multivalue fields do not form tables; each field is an independent list. When Splunk parses

action="A";parm="";ans="ERROR"

it will assign the value "null()" to the parm field. So the second value of the parm field is A06F as you saw.

You can try the fillnull command, but I don't know how that will affect a multi-valued field - as Splunk does not consider the parm field to be null since it has three values.

The best solution, if you have the ability to do it, is probably to make every field have a value. Declare a value such as "n/a" that can be used to indicate a purposefully empty field.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...