https://community.splunk.com/t5/Splunk-Search/Null-iplocation-data/m-p/185621#M53491 <P>Hello,<BR /> I have the following query:</P> <PRE><CODE> . . . | iplocation ClientIP | eval GeoLocation=case(Country="United States", "United States", Country=" ", "Views from Unknown Origins", Country!="United States" AND Country!=" ", "International") | top limit=3 GeoLocation | eval percent = round(percent,2) . " %" The output of this query returns results like this: GeoLocation count percent United States 900 90% International 100 10% </CODE></PRE> <P>However it is not returning if the value for Country is null, I've ran the search and I know for the given time range null values exist for the country field. Can this work within the eval case() query?</P> Mon, 02 Jun 2014 17:29:10 GMT hagjos43 2014-06-02T17:29:10Z https://community.splunk.com/t5/Splunk-Search/Null-iplocation-data/m-p/185621#M53491 <P>Hello,<BR /> I have the following query:</P> <PRE><CODE> . . . | iplocation ClientIP | eval GeoLocation=case(Country="United States", "United States", Country=" ", "Views from Unknown Origins", Country!="United States" AND Country!=" ", "International") | top limit=3 GeoLocation | eval percent = round(percent,2) . " %" The output of this query returns results like this: GeoLocation count percent United States 900 90% International 100 10% </CODE></PRE> <P>However it is not returning if the value for Country is null, I've ran the search and I know for the given time range null values exist for the country field. Can this work within the eval case() query?</P> Mon, 02 Jun 2014 17:29:10 GMT https://community.splunk.com/t5/Splunk-Search/Null-iplocation-data/m-p/185621#M53491 hagjos43 2014-06-02T17:29:10Z https://community.splunk.com/t5/Splunk-Search/Null-iplocation-data/m-p/185622#M53492 <P>I figured out my own issue. <EM>fillnull</EM> fixed it!</P> <P>Below is the working query:</P> <P>| iplocation ClientIP | <STRONG>fillnull value="Unknown" Country</STRONG> | eval GeoLocation=case(Country="United States", "Views from the United States", Country="Unknown", "Views from Unknown Origins", Country!="United States" AND Country!="Unknown", "International Views") | top limit=3 GeoLocation | eval percent = round(percent,2) . " %"</P> Mon, 02 Jun 2014 19:53:16 GMT https://community.splunk.com/t5/Splunk-Search/Null-iplocation-data/m-p/185622#M53492 hagjos43 2014-06-02T19:53:16Z