Is there any way to use fillnull conditionally

New Member

I have a requirement, where i need to switch the fillnull value between Excluded and N/A.

So is there any way that i can use fillnull conditionally.

Eg: if (status == "EXCLUDED") then fillnull value="EXCLUDED"
if (status == "N/A") then fillnull value="N/A"

Is this can be done ?

Please help me on this, i really need this kind of behavior in my dashboard.

Tags (1)
0 Karma


Try this

| eval FIELD_NAME=if(isnull(status),"EXCLUDED",'status')

0 Karma


How many fields are you trying to fill the null? If its one field, can't you use the conditional substitution using case or if ? Is it possible to share the search currently using ?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!