Knowledge Management

How to find count of empty values in splunk ?

karthi2809
Contributor

How to find count of empty values in splunk ?

raw events:

threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=start;ErrorCode=;ErrorMessage=
threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=60663a012118;Poller;EntityID=488M6027140;

How to find count of TransactionStatus=; for same threadId

Tags (3)
0 Karma

mayurr98
Super Champion

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

0 Karma

mayurr98
Super Champion

hey you can try something like this

Try this run anywhere search

| makeresults 
| eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=" 
| append 
    [| makeresults 
    | eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=start;ErrorCode=;ErrorMessage=" ] 
| append 
    [| makeresults 
    | eval _raw="threadId = 2695;StartTime=2017.11.12.16.50.36.036;EndTime=; Poller;EntityID=409M5585440; TransactionStatus=;ErrorCode=;ErrorMessage=60663a012118;Poller;EntityID=488M6027140;" ] 
| rex "TransactionStatus=(?<TransactionStatus>[^\;]+)" 
| fillnull TransactionStatus value=0 
| search TransactionStatus=0 | stats count as "empty transaction status count"

In your environment, you should write

<your_base_search> 
| rex "TransactionStatus=(?<TransactionStatus>[^\;]+)" 
| fillnull TransactionStatus value=0 
| search TransactionStatus=0 | stats count as "empty transaction status count"

let me know if this helps!

karthi2809
Contributor

In this how to get count

0 Karma

mayurr98
Super Champion

I have changed my query pls check

also instead of | search TransactionStatus=0 | stats count as "empty transaction status count"
you can also write | stats count(eval(TransactionStatus="0")) as "empty transaction status count"
you will get same results.

let me know if this helps!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...