Can anyone please explain the purpose of 'usenull' keyword with an example?

[gopi_c]

I've have been trying to search the use of 'usenull' keyboard. Could anyone explain this please.

[richgalloway]

From the docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/ListOfDataTypes):

usenull controls whether or not a series is created for events that do not contain the split-by field. This series is labeled by the value of the nullstr option, and defaults to NULL.

usenull is enabled by default so you only need to add usenull=f when you have a chart with "NULL" that you don't want.

[niketn]

One of better ways to remove NULL series being created in the timechart/chart because of null values in the split by field is to apply field filter before the timechart/chart command.

For example try the following two run anywhere searches based on Splunk's _internal index.

index=_internal sourcetype=splunkd earliest=-30s latest=now
| timechart span=10s count by cumulative_hits limit=0 useother=f


index=_internal sourcetype=splunkd earliest=-30s latest=now cumulative_hits=* 
| timechart span=10s count by cumulative_hits limit=0 useother=f