topic Re: fillnull for all the field names with a pattern in Splunk Search

fillnull for all the field names with a pattern

asingla — Thu, 17 Nov 2011 22:00:34 GMT

I need to use fillnull command but I don't have the exact field names before hand. All my fields starts (which I want to fill) starts with a common string i.e. err* . Though most of the commands in splunk do work with field name patterns e.g. table err* but fillnull err* is not working the way I want. Is there any other way to do this?

Re: fillnull for all the field names with a pattern

Ayn — Thu, 17 Nov 2011 22:39:16 GMT

As you noticed fillnull doesn't support wildcards for field names. If you don't supply any field names though, it will be applied to all fields. Unless this messes up something else in your search, that might solve your problems.

Re: fillnull for all the field names with a pattern

bhawkins1 — Fri, 14 Oct 2016 13:31:08 GMT

Unfortunately that messes something else up. Suppose I offer a hundred services to all of my n clients, but only want to label particular clients with a company name. I want to | fillnull value=0 service_*. Is there another (easy) method to achieve this?

Re: fillnull for all the field names with a pattern

genesiusj — Thu, 28 Mar 2024 13:35:47 GMT

@bhawkins1

Old post; you probably have an answer. I was looking for one and came up with this.

```Set blank_calc for same and not fields for future eval commands.``` | foreach *_same, *_not [| fillnull value="blank_calc" <<FIELD>>]

Worked for me.

God bless,
Genesius