topic Re: I need to fill missing values in a search as NULL in Splunk Search

I need to fill missing values in a search as NULL

abhijitp — Mon, 04 Apr 2016 23:54:49 GMT

I need to fill missing values from search items as NULL (not the string, but actual NULL values)

I see options to check if the values is NULL (isnull) or even fill NULL values with a string (fillnull). But what I need is to write the value to be NULL.

I searched but could not get an answer.

Thanks for all the help in this matter.
Abhi

Re: I need to fill missing values in a search as NULL

sideview — Mon, 04 Apr 2016 23:59:38 GMT

it's just null()

So you can do things like

| eval foo=if(sky="blue",foo,null())

that would conditionally erase the field "foo" from any rows that claim the sky is not blue.

Extra reading: A fair number of examples out there use "null" as though it was a reserved keyword in the eval command but it is not. those examples just happen to work because there is generally not a field called "null", and eval allows you to name any field at all. thus specifying null is the same as nonexistentField, and is generally null valued...

Re: I need to fill missing values in a search as NULL

abhijitp — Tue, 05 Apr 2016 00:01:47 GMT

Thanks. Let me try this out.

Re: I need to fill missing values in a search as NULL

MuS — Tue, 05 Apr 2016 00:01:48 GMT

Hi abhijitp,

did you look at the eval function null() http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/CommonEvalFunctions ?

null()  
This function takes no arguments and returns NULL. 
The evaluation engine uses NULL to represent "no value"; setting a field to NULL clears its value.

Hope this helps ...

cheers, MuS

Re: I need to fill missing values in a search as NULL

MuS — Tue, 05 Apr 2016 00:02:13 GMT

Again too slow today 🙂

Re: I need to fill missing values in a search as NULL

woodcock — Tue, 05 Apr 2016 12:54:57 GMT

I tied @sideview yesterday on an answer and we both had typos but OP selected him.

Re: I need to fill missing values in a search as NULL

sideview — Tue, 05 Apr 2016 16:22:54 GMT

I've picked up that old habit of answering questions the moment I get the "expert" notification from Splunk, but I do have that haunting feeling as I type, that someone else might be answering simultaneously. omg type faster!

Re: I need to fill missing values in a search as NULL

abhijitp — Tue, 05 Apr 2016 17:12:57 GMT

Thanks all the help. It worked as I wanted using this

| eval foo=if(sky="blue",foo,null())

Re: I need to fill missing values in a search as NULL

abhijitp — Tue, 05 Apr 2016 17:14:43 GMT

I really love the camaraderie 🙂

Re: I need to fill missing values in a search as NULL

kartik13 — Tue, 05 Apr 2016 17:34:15 GMT

Try this , it resolved my problem.

|fillnull value="#"

Re: I need to fill missing values in a search as NULL

MuS — Fri, 08 Apr 2016 12:37:50 GMT

HeHe, I have no problem at all if an OP selects @sideview 's answer to be the right one over mine, because @sideview will be for sure more right/correct/precise then I am !