https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552343#M156758 <P>According to the Tstats documentation, we can use fillnull_values which takes in a string value. I tired using that, but it didn't work.&nbsp;</P> Thu, 20 May 2021 08:24:25 GMT Godspeed_74 2021-05-20T08:24:25Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552202#M156707 <P>I am trying to fill the null values and using a datamodel. I want to use tstats and fill null values will "Null" using fillnull. How should I use it with tstats?&nbsp;</P> Wed, 19 May 2021 13:10:30 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552202#M156707 Godspeed_74 2021-05-19T13:10:30Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552252#M156724 <P>Could you please tell us more about the problem you are trying to solve?&nbsp; The tstats command does not have a 'fillnull' option.&nbsp; Recall that tstats works off the tsidx files, which IIRC does not store null values.</P> Wed, 19 May 2021 17:27:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552252#M156724 richgalloway 2021-05-19T17:27:47Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552343#M156758 <P>According to the Tstats documentation, we can use fillnull_values which takes in a string value. I tired using that, but it didn't work.&nbsp;</P> Thu, 20 May 2021 08:24:25 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552343#M156758 Godspeed_74 2021-05-20T08:24:25Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552387#M156784 <P>Please share your query.</P> Thu, 20 May 2021 12:48:45 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552387#M156784 richgalloway 2021-05-20T12:48:45Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552388#M156785 <P><SPAN>trying to use this<BR />| tstats summariesonly=true allow_old_summaries=true fillnull_value="NULL" count FROM datamodel=Linux_System.Linux_System&nbsp; WHERE (Linux_System.src_host=*) by&nbsp;src_host</SPAN></P> Thu, 20 May 2021 12:51:55 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552388#M156785 Godspeed_74 2021-05-20T12:51:55Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552401#M156788 <P>Do you have src_host fields with null values?</P> Thu, 20 May 2021 14:18:20 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552401#M156788 richgalloway 2021-05-20T14:18:20Z https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552407#M156792 <P>Yes, it has null values.&nbsp;</P> Thu, 20 May 2021 14:53:15 GMT https://community.splunk.com/t5/Splunk-Search/Using-fillnull-value-or-fillnull-value-with-Tstats/m-p/552407#M156792 Godspeed_74 2021-05-20T14:53:15Z