https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252368#M189338 <P>Try fillnull....</P> <P>index=ac_web sourcetype=access_log response_time &gt; 5 earliest=-7d@d latest=now <BR /> | fillnull value=MyNullName cs-uri-stem<BR /> | timechart span=1h count by cs-uri-stem</P> Tue, 29 Sep 2020 09:08:10 GMT snoobzilla 2020-09-29T09:08:10Z https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252367#M189337 <P>Hello,</P> <P>I'm a new user to splunk and want to know how to name a NULL column. For example, see below query.</P> <PRE><CODE>index=ac_web sourcetype=access_log response_time &gt; 5 earliest=-7d@d latest=now | timechart span=1h count by cs-uri-stem </CODE></PRE> <P>When I run this query, I get "NULL" name for the second column. How can I name it ?</P> <P>Thank you all !!</P> Fri, 18 Mar 2016 12:57:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252367#M189337 nlrdy 2016-03-18T12:57:29Z https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252368#M189338 <P>Try fillnull....</P> <P>index=ac_web sourcetype=access_log response_time &gt; 5 earliest=-7d@d latest=now <BR /> | fillnull value=MyNullName cs-uri-stem<BR /> | timechart span=1h count by cs-uri-stem</P> Tue, 29 Sep 2020 09:08:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252368#M189338 snoobzilla 2020-09-29T09:08:10Z https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252369#M189339 <P>Hi you can also do it by using tostring <BR /> eval cs-uri-stem=tostring(cs-uri-stem)</P> <P>The above returns value to "Null"(in most of the cases) </P> <P>then </P> <P>|time span=1h count by cs-uri-stem</P> <P>You can choose any method to so </P> Fri, 18 Mar 2016 15:33:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-name-NULL-column/m-p/252369#M189339 naidusadanala 2016-03-18T15:33:24Z