https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352047#M104182 <P>@dannyzen I have converted comment to Answer. Please accept to mark this question as answered!</P> Sun, 22 Apr 2018 09:35:05 GMT niketn 2018-04-22T09:35:05Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352043#M104178 <P>What is the best way to use fillnull for multiple fields? What is the best way to avoid it working for only the first field? <BR /> Some examples are:<BR /> | fillnull value=NULL field1 field2 field3<BR /> | fillnull value=NULL field1 | fillnull value=NULL field2 | fillnull value=NULL field3</P> <P>Thank You </P> Sat, 21 Apr 2018 23:44:07 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352043#M104178 dannyzen 2018-04-21T23:44:07Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352044#M104179 <P>@dannyzen, I would choose the following above adding separate pipes for each <CODE>fillnull</CODE>. Separate pipe means entire record will be used again for the 2nd fillnull and so on. The fillnull command being a streaming command it would make sense to call in a single place.</P> <PRE><CODE>| fillnull value=NULL field1 field2 field3 </CODE></PRE> <P>However, you can definitely test the actual performance using <A href="https://docs.splunk.com/Documentation/Splunk/latest/Search/ViewsearchjobpropertieswiththeJobInspector#Open_the_Search_job_inspector">Job Inspector</A> for both the compare and see the response time for yourself.</P> Sun, 22 Apr 2018 05:31:44 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352044#M104179 niketn 2018-04-22T05:31:44Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352045#M104180 <P>If wanted to substitute values for null values in all the fields <BR /> you can specify |fillnull </P> Sun, 22 Apr 2018 05:36:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352045#M104180 ssadanala1 2018-04-22T05:36:47Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352046#M104181 <P>Thank you<BR /> I will group the fields as field1 field2 field3</P> Sun, 22 Apr 2018 07:38:05 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352046#M104181 dannyzen 2018-04-22T07:38:05Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352047#M104182 <P>@dannyzen I have converted comment to Answer. Please accept to mark this question as answered!</P> Sun, 22 Apr 2018 09:35:05 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-for-multiple-fields/m-p/352047#M104182 niketn 2018-04-22T09:35:05Z