# Fix Null Output Issues When Parsing Data with DQL **URL:** \ **Category:** DQL\ **Tags:** dql, splunk\ **Created:** [May 29, 2025, 8:40pm UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877 "2025-05-29T20:40:40Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![sharmas2](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sharmas2](https://community.dynatrace.com/u/sharmas2)\ **Post date:** [May 29, 2025, 8:40pm UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/1 "2025-05-29T20:40:40Z")
Hi, “I have the following Splunk query, and I’m trying to generate the corresponding output in Dynatrace.” splunk query :- index=ngss\*\_sourcefire\_secevents | rex field=index “(?\\w.\*?)\_” | eval BlockedStatus = case(Like(src\_ip,“64.39.106.%”) AND InlineResultID=4 ," Qualys Blocked", Like(src\_ip,“154.59.121.%”) AND InlineResultID=4," Qualys Blocked", Like(src\_ip,“64.39.106.%”) AND InlineResultID=0," Qualys Not Blocked", Like(src\_ip,“154.59.121.%”) AND InlineResultID=0," Qualys Not Blocked", NOT Like(src\_ip,“64.39.106.%”) AND InlineResultID=4,“Non Qualys Blocked”, NOT Like(src\_ip,“154.59.121.%”) AND InlineResultID=4,“Non Qualys Blocked”, NOT Like(src\_ip,“64.39.106.%”) AND InlineResultID=0,“Non Qualys Not Blocked”, NOT Like(src\_ip,“154.59.121.%”) AND InlineResultID=0,“Non Qualys Not Blocked”) | stats count by Local\_Market BlockedStatus | rename eventtype as “Local Market”,count as “Total Critical Events” ===================================== **corresponding DQL is as below , where i am getting Null value ..** **Please not that in DQL Src\_ip is consider as “InitiatorIP”.** ![sharmas2_1-1748551157926.png](https://global.discourse-cdn.com/dynatrace/original/2X/2/2a475e69d8baa9b4f1ffdc8d1be1eb51a73cd3fb.png) DQL query is as below :- fetch logs // scanLimitGBytes: , samplingRatio: 1000 | filter contains(dt.security\_context,“ngss”) | parse content,“”“LD 'InlineResultID”:’ string:InlineResultID “,” “”" //| parse content, “”“LD ‘InitiatorIP’[^,]{1,100}?:“InitiatorIP’,'””“” | fieldsAdd market = substring(dt.security\_context, to: indexOf(dt.security\_context, “\_”)) | parse content, “”" LD ‘InitiatorIP\“:\”’ IPADDR:InitiatorIP “”" | parse content, “”" LD ‘InitiatorIP=’ IPADDR:InitiatorIP “”" | fieldsadd QualysBlocked=if((like(InitiatorIP,“154.59.121%”) or like(InitiatorIP,“64.39.106.%”) AND contains(InlineResultID,“0”) or contains(InlineResultID,“4”)),QualysBlocked) | fieldsadd QualysNotBlocked=if((like(InitiatorIP,“64.39.106%”) OR like(InitiatorIP,“154.59.121.%”) AND contains(InlineResultID,“0”) or contains(InlineResultID,“4”)),QualysNotBlocked) | fieldsadd NonQualysBlocked=if((like(InitiatorIP,“64.39.106%”) or like(InitiatorIP,“154.59.121%”) AND contains(InlineResultID,“0”) or contains(InlineResultID,“4”)),NonQualysBlocked) | fieldsadd NonQualysNotBlocked=if((like(InitiatorIP,“64.39.106%”) or like(InitiatorIP,“154.59.121.%”) AND contains(InlineResultID,“0”) or contains(InlineResultID,“4”)),NonQualysNotBlocked) | fieldsADD BlockedStatus = coalesce(QualysBlocked,QualysnotBlocked,NonQualysBlocked,NonQualysNotBlocked) //| fieldsADD Blockedstatus = coalesce(QualysBlocked,QualysnonBlocked) | summarize count() ,by:{market,BlockedStatus} Raw data is as below :- {“EventType”:“IntrusionEvent”,“EventSecond”:1748251156,“EventMicrosecond”:409890,“DeviceUUID”:“4888b6cc-5037-11eb-a0cd-bef67487e4a0”,“InstanceID”:21,“FirstPacketSecond”:1748246651,“ConnectionID”:45963,“InitiatorIP”:“198.18.76.185”,“ResponderIP”:“47.73.55.140”,“InitiatorPort”:54904,“ResponderPort”:16154,“Protocol”:“tcp”,“IngressInterface”:“DPB1-IN”,“EgressInterface”:“DPB1-OUT”,“IngressZone”:“Citadel-Dublin-DPB1”,“EgressZone”:“Citadel-Dublin-DPB1”,“PriorityID”:2,“GeneratorID”:3,“SignatureID”:56275,“SignatureRevision”:1,“Impact”:3,“IntrusionRuleMessage”:“SERVER-OTHER TRUFFLEHUNTER TALOS-2020-1185 attack attempt”,“Classification”:“Inappropriate content was detected”,“ClientApplication”:“Splunk”,“Application”:“TPNCP”,“IntrusionPolicy”:“Dublin-Non-Blocking-Policy\_S3”,“FirewallPolicy”:“NGSS2-Dublin”,“FirewallRule”:“To Management Systems Zone”,“NAP\_Policy”:“NGSS2-Dublin-NAP-Snort3”,“InlineResult”:“Would block”,“InlineResultReason”:"Intrusion Policy in \“Detection\” Inspection ---
**Author:** ![marco\_irmer](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/marco_irmer/32/3038_2.png) [@marco\_irmer](https://community.dynatrace.com/u/marco_irmer)\ **Post date:** [May 29, 2025, 11:04pm UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/2 "2025-05-29T23:04:19Z")
Hi there. I am noticing that you are using two different field names in your fieldsAdd statements. Additionally, your ‘if’ statement is not assigning string values. I recommend you use the same field name across the board and just assign a different value using the if statements. It would look something like this: ```javascript fetch logs // scanLimitGBytes: , samplingRatio: 1000 | filter contains(dt.security_context,"ngss") | parse content,"""LD 'InlineResultID":' string:InlineResultID "," """ //| parse content, """LD 'InitiatorIP'[^,]{1,100}?:"InitiatorIP','"""" | fieldsAdd market = substring(dt.security_context, to: indexOf(dt.security_context, "_")) | parse content, """ LD 'InitiatorIP\":\"' IPADDR:InitiatorIP """ | parse content, """ LD 'InitiatorIP=' IPADDR:InitiatorIP """ | fieldsadd BlockedStatus=if((like(InitiatorIP,"154.59.121%") or like(InitiatorIP,"64.39.106.%") AND contains(InlineResultID,"0") or contains(InlineResultID,"4")),"QualysBlocked") | fieldsadd BlockedStatus=if((like(InitiatorIP,"64.39.106%") OR like(InitiatorIP,"154.59.121.%") AND contains(InlineResultID,"0") or contains(InlineResultID,"4")),"QualysNotBlocked") // remainder of revised fieldsAdd statements go here ``` I was not able to test the whole query for you, but I hope this points you in the right direction. ---
**Author:** ![sharmas2](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sharmas2](https://community.dynatrace.com/u/sharmas2)\ **Post date:** [May 30, 2025, 1:54am UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/3 "2025-05-30T01:54:20Z")
[@marco\_irmer](https://community.dynatrace.com/user/19769)  i am getting error as “BlockedStatus overrides the existing field..” ---
**Author:** ![marco\_irmer](https://dub1.discourse-cdn.com/dynatrace/user_avatar/community.dynatrace.com/marco_irmer/32/3038_2.png) [@marco\_irmer](https://community.dynatrace.com/u/marco_irmer)\ **Post date:** [May 30, 2025, 10:05pm UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/4 "2025-05-30T22:05:16Z")
I believe that’s a warning only and should not affect the outcome of the query.. ---
**Author:** ![sharmas2](https://avatars.discourse-cdn.com/v4/letter/s/9fc348/32.png) [@sharmas2](https://community.dynatrace.com/u/sharmas2)\ **Post date:** [June 2, 2025, 4:07pm UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/5 "2025-06-02T16:07:55Z")
[@marco\_irmer](https://community.dynatrace.com/user/19769)  still null value coming.. tried below DQL as well .. =================== fetch logs // scanLimitGBytes: , samplingRatio: 1000 | filter dt.system.bucket == “custom\_group\_security” | filter contains(dt.security\_context,“ngss”) | filter contains(content, “SrcIP”, caseSensitive: false) | parse content, “”" LD ‘InitiatorIP\“:\”’ IPADDR:InitiatorIP “”" | parse content, “”" LD ‘SrcIP=’ IPADDR:SrcIP “”" | parse content,“”“LD 'InlineResultID”:’ string:InlineResultID “,” “”" | fieldsAdd market = substring(dt.security\_context, to: indexOf(dt.security\_context, “\_”)) | fieldsAdd market = replaceString(market, “cita”, “”) | fieldsAdd IP\_of\_interest = coalesce(SrcIP, InitiatorIP, “Not Found”) | fieldsAdd IP\_of\_interest = toString(IP\_of\_interest) | fieldsadd QualysBlocked=if((like(IP\_of\_interest, “154.59.121%”) or like(IP\_of\_interest, “64.39.106.%”)) and contains(InlineResultID,“4”) ,“QualysBlocked”, | fieldsadd QualysNotBlocked=if(((like(IP\_of\_interest, “64.39.106.%”) or (like(IP\_of\_interest, “154.59.121.%”)) AND contains(InlineResultID,“0”),“QualysNotBlocked”) | fieldsadd NonQualysBlocked=if(((NOT like(IP\_of\_interest,“64.39.106%”) AND contains(InlineResultID,“4”)) or (Not like(IP\_of\_interest, “154.59.121.%”)AND contains(InlineResultID,“4”))),“NonQualysBlocked”) | fieldsadd NonQualysNotBlocked=if(((NOT like(IP\_of\_interest,“64.39.106%”) AND contains(InlineResultID,“0”)) or (Not like(IP\_of\_interest, “154.59.121.%”)AND contains(InlineResultID,“0”))),“NonQualysNotBlocked”) | fieldsADD BlockedStatus = coalesce(QualysBlocked,QualysNotBlocked,NonQualysBlocked,NonQualysNotBlocked, “Sorry Ip not found”) | summarize count() ,by:{market,BlockedStatus} ---
**Author:** ![izabelarokita](https://avatars.discourse-cdn.com/v4/letter/i/b487fb/32.png) [@izabelarokita](https://community.dynatrace.com/u/izabelarokita)\ **Post date:** [December 18, 2025, 10:44am UTC](https://community.dynatrace.com/t/fix-null-output-issues-when-parsing-data-with-dql/51877/6 "2025-12-18T10:44:02Z")
Hey [@sharmas2](https://community.dynatrace.com/user/88797) , I just wanted to check in and see if you still need help with this. If so, I’d be happy to look into it for you! :blush: Please let me know what works best for you.