https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-strange-results-with-the-fillnull-command-when/m-p/276389#M83377 <P>I have a search that looks like:</P> <PRE><CODE>multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo" </CODE></PRE> <P>When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using <CODE>tstats</CODE>, those fields have the "N/A" like they are supposed to.</P> <P>Can anyone explain why this is happening?</P> <P>Thx.</P> Tue, 13 Sep 2016 20:33:23 GMT responsys_cm 2016-09-13T20:33:23Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-strange-results-with-the-fillnull-command-when/m-p/276389#M83377 <P>I have a search that looks like:</P> <PRE><CODE>multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo" </CODE></PRE> <P>When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using <CODE>tstats</CODE>, those fields have the "N/A" like they are supposed to.</P> <P>Can anyone explain why this is happening?</P> <P>Thx.</P> Tue, 13 Sep 2016 20:33:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-strange-results-with-the-fillnull-command-when/m-p/276389#M83377 responsys_cm 2016-09-13T20:33:23Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-strange-results-with-the-fillnull-command-when/m-p/276390#M83378 <P>I had a problem like your and I solved using eval<BR /> try this</P> <P><EM>eval myfield=if(isnull(myfield),"N/A",myfield)</EM></P> <P>Bye</P> <P>Giuseppe</P> Fri, 16 Sep 2016 07:21:35 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-strange-results-with-the-fillnull-command-when/m-p/276390#M83378 gcusello 2016-09-16T07:21:35Z