https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/462747#M130476 <P>I just played around with it for awhile - I had initially thought it was because you had "count" and that can never return null, but I tried values as well and that yielded nothing either. If no one else can answer, you have the workaround of adding on line 2 <CODE>| fillnull value="NA"</CODE>, and should probably open a support ticket. Also, there are no examples of it in usage here: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats#Examples">https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats#Examples</A> which is a bit bothersome. </P> Tue, 17 Dec 2019 00:35:17 GMT aberkow 2019-12-17T00:35:17Z https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/462746#M130475 <P>According to Splunk document in "<A href="https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats" target="_blank">tstats</A>" command, the optional argument, fillnull_value, is available for my Splunk version, 7.2; however, this optional argument doesn't seem working at all. I got an error message: "... <STRONG>The argument 'fillnull_value=NA' is invalid</STRONG>". Does anyone have any clues? Thanks.</P> <PRE><CODE>| tstats summariesonly=true fillnull_value="NA" count from datamodel=Email.All_Email where * by All_Email.src_user </CODE></PRE> Wed, 30 Sep 2020 03:20:10 GMT https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/462746#M130475 lucas4394 2020-09-30T03:20:10Z https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/462747#M130476 <P>I just played around with it for awhile - I had initially thought it was because you had "count" and that can never return null, but I tried values as well and that yielded nothing either. If no one else can answer, you have the workaround of adding on line 2 <CODE>| fillnull value="NA"</CODE>, and should probably open a support ticket. Also, there are no examples of it in usage here: <A href="https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats#Examples">https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats#Examples</A> which is a bit bothersome. </P> Tue, 17 Dec 2019 00:35:17 GMT https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/462747#M130476 aberkow 2019-12-17T00:35:17Z https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/517113#M145379 <P>According to the docs this option to `tstats` were introduced in 8.0.0.&nbsp;<BR />I just recently discovered myself. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P><P>Cheers,<BR />Rolf</P> Mon, 31 Aug 2020 20:05:48 GMT https://community.splunk.com/t5/Splunk-Search/The-fillnull-value-option-in-tstats-command/m-p/517113#M145379 rvaglid 2020-08-31T20:05:48Z