Splunk Search

Behaviour with the fillnull & replace commands

akarivaratharaj
Communicator
host=* sourcetype=* 

|replace *.zip WITH * IN Object |
replace *.csv WITH * IN Object |
replace *.null WITH * IN Object |
replace *.xls WITH * IN Object |
replace *.pdf WITH * IN Object 

|fillnull value=0, Bytes_W 

|stats sum(Bytes_W)

In the above code, I am using replace command to replace the field values of Object with * wherever it has values with some extension like .csv, .null, etc., Also I am using the fillnull command to fill the value as ‘0’ wherever the field Bytes_W is not available.

The query with replace command as first and followed by fillnull is providing the Bytes_W result as 0 (though there are data for the field Bytes_W). Whereas the same query, if I change the position of the commands as fillnull first and followed by replace command, providing the correct results.

Note:- This issue is happening only during a particular time period.

Not sure what is causing the problem over here. Could anyone please help me in this case.

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@akarivaratharaj

|fillnull value=0, Bytes_W will only work if there a single value available in Bytes_W field across the results.

Null values are field values that are missing in a particular result but present in another result.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/fillnull

Can you please try below search?

 host=* sourcetype=* 

 |replace *.zip WITH * IN Object |
 replace *.csv WITH * IN Object |
 replace *.null WITH * IN Object |
 replace *.xls WITH * IN Object |
 replace *.pdf WITH * IN Object 

| eval Bytes_W=if(isnull(Bytes_W),0,Bytes_W )

 |stats sum(Bytes_W)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...