https://community.splunk.com/t5/Splunk-Search/Seprating-null-and-empty-fields/m-p/110787#M28976 <P>Hi All,</P> <P>I have multiple cases with my date:<BR /> some have empty src value: e.g,<BR /> id=abc src= lr=2<BR /> some does not have src at all: e.g.,<BR /> id=cde lr=5<BR /> and the rest have src with values: e.g.,<BR /> id=rty src=df lr=5</P> <P>The question is how can I separate these three cases? I tried isnull(src) but it does not work.</P> <P>Thanks</P> Wed, 23 Oct 2013 03:37:56 GMT gimbil 2013-10-23T03:37:56Z https://community.splunk.com/t5/Splunk-Search/Seprating-null-and-empty-fields/m-p/110787#M28976 <P>Hi All,</P> <P>I have multiple cases with my date:<BR /> some have empty src value: e.g,<BR /> id=abc src= lr=2<BR /> some does not have src at all: e.g.,<BR /> id=cde lr=5<BR /> and the rest have src with values: e.g.,<BR /> id=rty src=df lr=5</P> <P>The question is how can I separate these three cases? I tried isnull(src) but it does not work.</P> <P>Thanks</P> Wed, 23 Oct 2013 03:37:56 GMT https://community.splunk.com/t5/Splunk-Search/Seprating-null-and-empty-fields/m-p/110787#M28976 gimbil 2013-10-23T03:37:56Z https://community.splunk.com/t5/Splunk-Search/Seprating-null-and-empty-fields/m-p/110788#M28977 <P>Try:</P> <PRE><CODE>search | fillnull value=null | stats count by id, src, lr </CODE></PRE> <P>fillnull will fill empty values even when the field does not exist.</P> Wed, 23 Oct 2013 04:25:04 GMT https://community.splunk.com/t5/Splunk-Search/Seprating-null-and-empty-fields/m-p/110788#M28977 lukejadamec 2013-10-23T04:25:04Z