Fulfill empty table entries

zugji — Sun, 28 Apr 2013 19:41:20 GMT

Is there a way I can fulfill empty tables.
name="*" | chart count by name,severity | rename 1 as alert, 2 as critical, 3 as error, 4 as warn, 5 as notice, 6 as info | table name,alert,critical,error,warn,notice,info | sort - alert,critical,error,warn,notice,info | head 20

This gives a table back with empty fields. Is there a way I can fulfill empty fields with 0?

Example:

name alert critical error warn notice info
t1                   2     1    1      0
t2                   1     1    0      0

Expectation:

name alert critical error warn notice info
t1   0     0         2     1    1      0
t2   0     0         1     1    0      0

Regards,
Christian

Re: Fulfill empty table entries

kristian_kolb — Sun, 28 Apr 2013 19:53:20 GMT

You should have a look at the fillnull command.

...| fillnull alert critical | ...

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull

Hope this helps,

Kristian

topic Fulfill empty table entries in Splunk Search

Fulfill empty table entries

Re: Fulfill empty table entries