- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why am I getting null values in my results?
human96
Communicator
10-18-2022
08:07 AM
I have a search
index="xyz" sourcetype="csv"
| fillnull value="unknownMan" field1 field2 field3 field4
| eventstats dc(field1) as xyz by field2 field3 field4
| table field1 field2 field3 field4
while running this, i'm getting NULL values in the results?
Please help me with this why NULL values will be coming when there is no NULL values in the events??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
johnhuang
Motivator
10-18-2022
09:01 AM
When you say "NULL" value, I am assuming you mean the value is blank/empty rather than literal.
Try this to set all the empty values to null.
index="xyz" sourcetype="csv"
| foreach * [eval <<FIELD>>=IF(<<FIELD>>="", NULL(), <<FIELD>>)]
| fillnull value="unknownMan" field1 field2 field3 field4
| eventstats dc(field1) as xyz by field2 field3 field4
| table field1 field2 field3 field4
