Splunk Search

Behaviour with the fillnull & replace commands

akarivaratharaj
Communicator
host=* sourcetype=* 

|replace *.zip WITH * IN Object |
replace *.csv WITH * IN Object |
replace *.null WITH * IN Object |
replace *.xls WITH * IN Object |
replace *.pdf WITH * IN Object 

|fillnull value=0, Bytes_W 

|stats sum(Bytes_W)

In the above code, I am using replace command to replace the field values of Object with * wherever it has values with some extension like .csv, .null, etc., Also I am using the fillnull command to fill the value as ‘0’ wherever the field Bytes_W is not available.

The query with replace command as first and followed by fillnull is providing the Bytes_W result as 0 (though there are data for the field Bytes_W). Whereas the same query, if I change the position of the commands as fillnull first and followed by replace command, providing the correct results.

Note:- This issue is happening only during a particular time period.

Not sure what is causing the problem over here. Could anyone please help me in this case.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@akarivaratharaj

|fillnull value=0, Bytes_W will only work if there a single value available in Bytes_W field across the results.

Null values are field values that are missing in a particular result but present in another result.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/fillnull

Can you please try below search?

 host=* sourcetype=* 

 |replace *.zip WITH * IN Object |
 replace *.csv WITH * IN Object |
 replace *.null WITH * IN Object |
 replace *.xls WITH * IN Object |
 replace *.pdf WITH * IN Object 

| eval Bytes_W=if(isnull(Bytes_W),0,Bytes_W )

 |stats sum(Bytes_W)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...