https://community.splunk.com/t5/Splunk-Search/Stats-list-removes-empty-strings-in-the-search-GUI/m-p/472020#M132802 <P>Per @dmarling a workaround to this bug is to <CODE>fillnull</CODE> with alt+255</P> Thu, 13 Feb 2020 21:49:14 GMT nick405060 2020-02-13T21:49:14Z https://community.splunk.com/t5/Splunk-Search/Stats-list-removes-empty-strings-in-the-search-GUI/m-p/472019#M132801 <PRE><CODE>| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="" | stats list(a) </CODE></PRE> <P>vs.</P> <PRE><CODE>| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="0" | stats list(a) </CODE></PRE> <P>... shows only one result, even though</P> <PRE><CODE>| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="" | stats list(a) AS z | eval w=mvcount(z) | table w </CODE></PRE> <P>... counts 2. Isn't this the whole point of using <CODE>fillnull</CODE>? What's the most elegant workaround? This seems to be super dangerous and misleading </P> Thu, 13 Feb 2020 21:47:48 GMT https://community.splunk.com/t5/Splunk-Search/Stats-list-removes-empty-strings-in-the-search-GUI/m-p/472019#M132801 nick405060 2020-02-13T21:47:48Z https://community.splunk.com/t5/Splunk-Search/Stats-list-removes-empty-strings-in-the-search-GUI/m-p/472020#M132802 <P>Per @dmarling a workaround to this bug is to <CODE>fillnull</CODE> with alt+255</P> Thu, 13 Feb 2020 21:49:14 GMT https://community.splunk.com/t5/Splunk-Search/Stats-list-removes-empty-strings-in-the-search-GUI/m-p/472020#M132802 nick405060 2020-02-13T21:49:14Z