topic Re: Fillnull command is not working in my search for specific sourcetype in Splunk Search

Fillnull command is not working in my search for specific sourcetype

Gowtham0809 — Tue, 30 Jul 2019 05:42:39 GMT

Hi,

I been using fill null commands on my other searched without any issue, but in a specific case i am unable to get any response by using fillnull,

the data is indexed by a source type called CSV, (specific for CSV files), I will have 1000's of empty values in fields so I need to filter our based on my needs. one on my need is to filter it my means if null values. SO I want to replace the empty values in a filled with value-NULL. I used below format.

field name =""RWI State" and i used the fillnull as ....| fillnull value=NULL "RWI State".

but its not filling the filed with NULL values

Thanks

Re: Fillnull command is not working in my search for specific sourcetype

Gowtham0809 — Tue, 30 Jul 2019 05:44:29 GMT

adding to the post, replace command works with replacing empty values NULL. MY usecase is to use fillnull

Re: Fillnull command is not working in my search for specific sourcetype

woodcock — Tue, 30 Jul 2019 05:55:54 GMT

First of all, fields with spaces are EVIL but try this:

... | fillnull value="NULL" "RWI State"

If that doesn't work, then try this:

| eval "RWI State" = if(len('RWI State') == 0, "NULL", 'RWI State')

Re: Fillnull command is not working in my search for specific sourcetype

Gowtham0809 — Tue, 30 Jul 2019 09:37:45 GMT

Thanks for the update, I have many fields such as "RWI State", So so I need to use EVAL for all my fields, or can i do it for all the fields to replace null values. Note, I have too many fields in my data sheet.

Re: Fillnull command is not working in my search for specific sourcetype

woodcock — Tue, 30 Jul 2019 17:38:37 GMT

There is the foreach command that you can use to cover multiple fields with one command.