topic Re: Why does Splunk auto fillnull my timechart? in Splunk Search

Why does Splunk auto fillnull my timechart?

the_wolverine — Tue, 29 Sep 2020 11:09:59 GMT

Did this change occur recently? Why would timechart auto fillnull my field in a timechart?

Example:
index=main | timechart count by level

RESULT:
I get a level=NULL* value in my table (Verified that there is no level=NULL in my data)

** index=main | stats count by level
does NOT insert a fillnull on my level field.

Re: Why does Splunk auto fillnull my timechart?

somesoni2 — Tue, 27 Sep 2016 04:11:38 GMT

What version of Splunk are you using? Do you get the same behaviour if you use following?

index=main level=*| timechart count by level

Re: Why does Splunk auto fillnull my timechart?

jkat54 — Tue, 27 Sep 2016 04:29:18 GMT

you said "in your table" are you using timechart to create a table of events by time? If so I think you should use | stats count by level, _time instead of timechart.

Can you try that and let us know the results?

Re: Why does Splunk auto fillnull my timechart?

JDukeSplunk — Tue, 27 Sep 2016 13:45:38 GMT

It might not solve for the WHY but it will fix the issue. If you are not concerned with what the null's are.

index=main | timechart count by level usenull=f

If you are not concerned with what the null's are.

Re: Why does Splunk auto fillnull my timechart?

the_wolverine — Tue, 27 Sep 2016 21:29:13 GMT

Yes, using level=* filter is the obvious. Question is whether this behavior changed. stats doesn't inject a fillnull -- timechart does inject a fillnull.

Version is tagged 6.3.4.

Either stats or timechart produces a table.

Re: Why does Splunk auto fillnull my timechart?

the_wolverine — Tue, 27 Sep 2016 21:30:47 GMT

Yes the solution to workaround the unwanted fill nulls is to use level=* filter in the base query.

However, this is not required for stats -- and just wondering when the change to timechart occurred (to inject fillnull value=NULL automatically) or maybe I just wasn't paying attention to timechart behavior all of these years.

Re: Why does Splunk auto fillnull my timechart?

JDukeSplunk — Mon, 03 Oct 2016 14:31:01 GMT

I've never seen nulls crop up in timechart unless there was some value, either in the data or generated by an eval producing it.

I know stats is not showing your nulls, and I think you already tried level=*. The only thing I can think of is to see if running a subsearch after the timechart (or chart) might work, with a |search level=null and see if you get a result.

Re: Why does Splunk auto fillnull my timechart?

the_wolverine — Tue, 04 Oct 2016 04:09:06 GMT

search level=null returns nothing and the job inspector clearly shows that Splunk is adding:

| fillnull value=NULL "level"

This is why I suspect something has changed in recent versions -- this is version 6.3.4. I'm a long time Splunk user and this is the first time I've noticed it .. or like I said, I wasn't paying attention previously which I doubt as I've previously created workarounds for missing spans due to non-existent values.