topic Re: Search results include fields with no values, can this be done? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42647#M9976 <P>You need fillnull before your stats command, not after.</P> Thu, 23 May 2013 12:21:50 GMT Ayn 2013-05-23T12:21:50Z Search results include fields with no values, can this be done? https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42643#M9972 <P>Is it possible to get search results in a table when only some of the results will have all the fields associated with them?</P> <P>Currently I cannot get this to work.</P> <P>For example....</P> <TABLE class="tableizer-table"> <TBODY><TR class="tableizer-firstrow"><TH>Date</TH><TH>Time</TH><TH>User</TH><TH>URL</TH><TH>Term</TH><TH>Product</TH></TR> <TR><TD>15/05/2013</TD><TD>10:01:02</TD><TD>User123456</TD><TD>/Home/</TD><TD>-</TD><TD>-</TD></TR> <TR><TD>15/05/2013</TD><TD>10:01:32</TD><TD>User123456</TD><TD>/Products/</TD><TD>-</TD><TD>-</TD></TR> <TR><TD>15/05/2013</TD><TD>10:01:53</TD><TD>User123456</TD><TD>/Products/Product1/</TD><TD>-</TD><TD>ID12345678</TD></TR> <TR><TD>15/05/2013</TD><TD>10:02:42</TD><TD>User123456</TD><TD>/Search/</TD><TD>-</TD><TD>-</TD></TR> <TR><TD>15/05/2013</TD><TD>10:03:12</TD><TD>User123456</TD><TD>/Search/Results/</TD><TD>Car</TD><TD>-</TD></TR> </TBODY></TABLE> Wed, 22 May 2013 15:10:31 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42643#M9972 DanielFordWA 2013-05-22T15:10:31Z Re: Search results include fields with no values, can this be done? https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42644#M9973 <P>fillnull?</P> <PRE><CODE>... | fillnull value="-" Term Product | ... </CODE></PRE> Wed, 22 May 2013 15:16:42 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42644#M9973 Ayn 2013-05-22T15:16:42Z Re: Search results include fields with no values, can this be done? https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42645#M9974 <P>If in my search query I use the below...</P> <P>stats count by Date Time User URL Term | Fields Date Time User URL Term | fillnull value="-" Term </P> <P>This will only return the last result on the above table. The previous 4 results do not have the field "Term" associated with them, however I would like these to populate with a blank if that is the case.</P> Thu, 23 May 2013 11:52:58 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42645#M9974 DanielFordWA 2013-05-23T11:52:58Z Re: Search results include fields with no values, can this be done? https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42646#M9975 <P>I usually use <STRONG>eval</STRONG> to handle these. Something like:</P> <PRE><CODE>...my search params... | eval TermProduct=if(isnull(TermProduct),"None",TermProduct) | ...other search params... </CODE></PRE> <P>then adjust your search to account for "None" (or whatever you want to <STRONG>eval</STRONG> it to) in that field.</P> Thu, 23 May 2013 12:18:54 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42646#M9975 wpreston 2013-05-23T12:18:54Z Re: Search results include fields with no values, can this be done? https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42647#M9976 <P>You need fillnull before your stats command, not after.</P> Thu, 23 May 2013 12:21:50 GMT https://community.splunk.com/t5/Splunk-Search/Search-results-include-fields-with-no-values-can-this-be-done/m-p/42647#M9976 Ayn 2013-05-23T12:21:50Z