|
Let's say I have events A and B: How can I find all events where field2 is missing (essentially event B in this tiny example)? |
|
Ok, so I tried a few things, and this is what ended up working: It would be more intuitive if this worked also: field2="" means something very different. It means that field2 exists, but has an empty string value.
(03 Feb '10, 04:49)
gkanapathy ♦
yes, but in splunk land, would a field ever exist and be empty?
(03 Feb '10, 18:02)
hulahoop ♦
1
It's a valid state of a field. You can get there with regex extractions. Do you mean that this is an undesirable thing?
(03 Feb '10, 18:29)
jrodman ♦
hey k8to, i'm just wondering if it can actually happen, and if splunk would behave consistently.
(04 Feb '10, 05:12)
hulahoop ♦
Yes, it can happen.
(31 Aug '10, 05:59)
gkanapathy ♦
|
|
Note that using will not work either. This will never return any events, as it will always be false. This means that It seems like they are logically equivalent, but Splunk does not treat them so. Is that a fair statement?
(03 Feb '10, 06:00)
hulahoop ♦
1
No they are not logically equivalent. There is a difference between being empty, and not existing.
(03 Feb '10, 06:43)
gkanapathy ♦
Well, I guess it depends what you mean by "logically equivalent", but there is a difference in meaning regardless of how Splunk treats them.
(03 Feb '10, 06:45)
gkanapathy ♦
|
