https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705235#M238821 <P>You did mention that field2 doesn't exist and that is exactly what fillnull will do. It will create a field in an event where there is no field for that event and it gives it the value you specify.</P><P>So when you say it didn't work, can you elaborate - what didn't work. field2 WILL be created if it does not exist in a log source where there is no field2 value, so <STRONG>top field1 field2 field3 field4</STRONG> will not ignore results where field2 does not exist, because after fillnull, it will ALWAYS exist.</P><P>Perhaps you can show examples of the data and your SPL</P> Tue, 26 Nov 2024 02:20:39 GMT bowesmana 2024-11-26T02:20:39Z https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705226#M238817 <P>When I search I want to show the top results by a specific field "field1" and also show "field2" and "field3". Problem is some results don't have a "field2", but do contain the other fields. I get different results when I search if I include a "field2" in the results. Can I search and return all results weather or not "field2" exists?</P><P>| top field1 = all possible results<BR />| top field1 field2 field3 = only results with all fields<BR /><BR />What I want is just to show a blank line where "field2" would be on matches that don't have a "field2". Basically make "field2" optional.</P> Mon, 25 Nov 2024 21:20:37 GMT https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705226#M238817 thrtnastrx 2024-11-25T21:20:37Z https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705228#M238818 <P>Use</P><LI-CODE lang="markup">| fillnull field2 value=""</LI-CODE><P>That will force all events with no field2 to have an empty value, rather than a null value.</P><P>That's the normal way to force potentially null fields to exist when using them in split by clauses, or top, as in your case.</P> Mon, 25 Nov 2024 21:29:35 GMT https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705228#M238818 bowesmana 2024-11-25T21:29:35Z https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705232#M238819 <P>Thanks for the reply but that didn't work; I should have mentioned that "field2" doesn't exist in the source data in some of the logs.&nbsp;&nbsp; So some logs are:</P><P>field1, field2, field3, field4</P><P>and others are</P><P>field1, field3, field4,</P><P>So the header "field2" doesn't exist at all in some of the data.&nbsp; I want to return result weather or not they have a "field2".</P> Mon, 25 Nov 2024 23:59:37 GMT https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705232#M238819 thrtnastrx 2024-11-25T23:59:37Z https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705235#M238821 <P>You did mention that field2 doesn't exist and that is exactly what fillnull will do. It will create a field in an event where there is no field for that event and it gives it the value you specify.</P><P>So when you say it didn't work, can you elaborate - what didn't work. field2 WILL be created if it does not exist in a log source where there is no field2 value, so <STRONG>top field1 field2 field3 field4</STRONG> will not ignore results where field2 does not exist, because after fillnull, it will ALWAYS exist.</P><P>Perhaps you can show examples of the data and your SPL</P> Tue, 26 Nov 2024 02:20:39 GMT https://community.splunk.com/t5/Splunk-Search/Top-with-optional-field-results/m-p/705235#M238821 bowesmana 2024-11-26T02:20:39Z