- Splunk Answers
- :
- Splunk Administration
- :
- Knowledge Management
- :
- How to find count of empty values in splunk ?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to find count of empty values in splunk ?
How to find count of empty values in splunk ?
raw events:
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=start;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=60663a012118;Poller;EntityID=488M6027140;
How to find count of TransactionStatus=; for same threadId
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hey you can try something like this
Try this run anywhere search
| makeresults
| eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage="
| append
[| makeresults
| eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=start;ErrorCode=;ErrorMessage=" ]
| append
[| makeresults
| eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=60663a012118;Poller;EntityID=488M6027140;" ]
| rex "TransactionStatus=(?<TransactionStatus>[^\;]+)"
| fillnull TransactionStatus value=0
| search TransactionStatus=0 | stats count as "empty transaction status count"
In your environment, you should write
<your_base_search>
| rex "TransactionStatus=(?<TransactionStatus>[^\;]+)"
| fillnull TransactionStatus value=0
| search TransactionStatus=0 | stats count as "empty transaction status count"
let me know if this helps!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In this how to get count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have changed my query pls check
also instead of | search TransactionStatus=0 | stats count as "empty transaction status count"
you can also write | stats count(eval(TransactionStatus="0")) as "empty transaction status count"
you will get same results.
let me know if this helps!
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
