topic Re: fillnull not working in Splunk Search

fillnull not working

logloganathan — Wed, 04 Apr 2018 08:43:01 GMT

I have a query
base query | stats count by ABC | fillnull

but i am getting "no result"

instead of this, i want to display ABC count as "zero"

Re: fillnull not working

p_gurav — Wed, 04 Apr 2018 08:54:20 GMT

Can you share whole query? Is ABC field exist?

Re: fillnull not working

logloganathan — Wed, 04 Apr 2018 09:03:12 GMT

yes..it exist..please consider ABC is name of error

Re: fillnull not working

p_gurav — Wed, 04 Apr 2018 09:12:51 GMT

can you try :

 | stats count AS abc_count by ABC | fillnull abc_count value=0

Re: fillnull not working

FrankVl — Wed, 04 Apr 2018 09:14:02 GMT

I don't entirely follow what you're trying to achieve, but the purpose of fillnull is to populate empty fields with a null value, not to generate results when there are none. When the stats command returns 0 results, there is nothing to apply "fillnull" on.

If you can elaborate a bit more what you want to achieve (and if possible show some sample data and expected outcomes) we can try and help you find a solution that does work.

Re: fillnull not working

logloganathan — Wed, 04 Apr 2018 10:08:49 GMT

still i am getting the same result

Re: fillnull not working

logloganathan — Wed, 04 Apr 2018 10:10:46 GMT

stats command displaying "no result found" but i need value zero to be displayed

Re: fillnull not working

p_gurav — Wed, 04 Apr 2018 10:16:05 GMT

Do you need something like this:

https://answers.splunk.com/answers/582253/replacing-no-results-found-with-0.html

Re: fillnull not working

logloganathan — Wed, 04 Apr 2018 10:30:42 GMT

yes..could you please modify and provide the query

Re: fillnull not working

kmaron — Wed, 04 Apr 2018 14:44:11 GMT

Try this - from here: https://answers.splunk.com/answers/467823/if-there-are-no-results-found-how-do-i-get-my-sear.html

base query | stats count by ABC
 | appendpipe [ stats count | eval "NoResults"="0"  | where count=0 |table "NoResults"]

Re: fillnull not working

skoelpin — Wed, 04 Apr 2018 14:54:33 GMT

Try this

base query 
| append [|makeresults | eval count=""]
| stats count by ABC
|eval count=if(isnotnull(count),0,'count')

Re: fillnull not working

logloganathan — Thu, 05 Apr 2018 12:24:45 GMT

Awesome...i tried this query and its working fine..

Re: fillnull not working

logloganathan — Thu, 05 Apr 2018 12:27:42 GMT

Thanks for your help..still same result when i use this query

Re: fillnull not working

skoelpin — Thu, 05 Apr 2018 14:43:40 GMT

Works on mine..