topic Re: Why fillnull command has 2 type processing??(distributable streaming command/dataset processing) in Splunk Dev

Why does fillnull command have two type processing? (distributable streaming command/dataset processing)

munang — Fri, 09 Sep 2022 16:57:18 GMT

Splunk documentation said

"fillnull command is a distributable streaming command when a field-list is specified. When no field-list is specified, the fillnull command fits into the dataset processing type"

I wonder why it works as dataset processing if no fields are specified. The results are all the same anyway, but there must be a reason.

Thanks for letting us know.

Re: Why fillnull command has 2 type processing??(distributable streaming command/dataset processing)

richgalloway — Fri, 09 Sep 2022 12:31:11 GMT

When a field name is specified, it's easy for an indexer to see that the field has no value and substitute the fill value. Without a field name specified, it has to know the full set of fields to know which have null values. That's not a distributable function.

Re: Why fillnull command has 2 type processing??(distributable streaming command/dataset processing)

munang — Fri, 09 Sep 2022 14:08:46 GMT

Thank you!!