Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Null value issue

$
0
0
Hi Guys, Our search query is like this **LogName=Application SourceName=Script | rex "Days Remaining: (?.*)days" | rex ": Origin=(?.+?)\," | rex (?.+?)\; | table CertificateName, DaysRemaining** Output will provide us a table with 2 columns as “CertificateName” and “DaysRemaining” in which “CertificateName” will have the names of the Certificates and “DaysRemaining” will have the days left for certificate expiry. But sometimes “DaysRemaining” column will have not any numbers for few of the “CertificateNames” and remains blank as attached here in the screen shot. Is there any way; 1. We can remove the rows which has no values (blank rows) using the above query 2. Can we input some text string like “Not Available” where ever we have these null value using the above query Please advise.

Viewing all articles
Browse latest Browse all 47296

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>