topic Re: Is there any way to use fillnull conditionally in Splunk Search

Is there any way to use fillnull conditionally

Maniteja81 — Tue, 17 Sep 2019 14:09:11 GMT

I have a requirement, where i need to switch the fillnull value between Excluded and N/A.

So is there any way that i can use fillnull conditionally.

Eg: if (status == "EXCLUDED") then fillnull value="EXCLUDED"
OR
if (status == "N/A") then fillnull value="N/A"

Is this can be done ?

Please help me on this, i really need this kind of behavior in my dashboard.

Re: Is there any way to use fillnull conditionally

renjith_nair — Tue, 17 Sep 2019 14:22:34 GMT

@Maniteja81,
How many fields are you trying to fill the null? If its one field, can't you use the conditional substitution using case or if ? Is it possible to share the search currently using ?

Re: Is there any way to use fillnull conditionally

skoelpin — Tue, 17 Sep 2019 14:34:05 GMT

Try this

| eval FIELD_NAME=if(isnull(status),"EXCLUDED",'status')