Splunk Search

Counting values

mkrauss1
Explorer

Hi,
i have a key value pair say FTYPE=VAL1 and FTYPE=VAL2 and create a timechart with

earliest=-1d@d latest=now | timechart
count(eval(FTYPE=VAL1)) as TYPE1, count(eval(FTYPE="VAL2")) as TYPE2

All for sudden i notice that the expected numbers are wrong because some of the FTYPE values are blank like FTYPE=

How can i create the timechart where blank FTYPE values are treated as VAL1? I tried something like
count(eval(FTYPE=VAL1 OR FTYPE="")) as TYPE1

somehow that doesn't work either.

Any ideas? Many thanks ...

Tags (1)
0 Karma
1 Solution

jonuwz
Influencer

You test for null like this : isnull(field)
So your search would be :

FTYPE=VAL1 OR isnull(FTYPE)

or, you could jsut do this beforehand :

... | eval FTYPE=if(isnull(FTYPE),"VAL1",FTYPE) | ...

View solution in original post

0 Karma

jonuwz
Influencer

You test for null like this : isnull(field)
So your search would be :

FTYPE=VAL1 OR isnull(FTYPE)

or, you could jsut do this beforehand :

... | eval FTYPE=if(isnull(FTYPE),"VAL1",FTYPE) | ...
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...