Use fillnull_value with Tstats

Dashboards & Visualizations

I am trying to use fillnull_value with Tstats like it is stated in the documentation, but it is not working as desired as it's not giving null values.

| tstats summariesonly=true allow_old_summaries=true fillnull_value="NULL" count FROM datamodel=Linux_System.Linux_System WHERE (Linux_System.src_host=*) by src_host

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...