Splunk Search
Highlighted

Can't fillnull on fields in REST generated table?

Champion

Why doesn't fillnull work here?

| rest /servicesNS/-/-/saved/searches splunkserver=local | search disabled=0 isscheduled=1 | fillnull dispatch.earliesttime | table author, title, disabled, isscheduled, cronschedule, search, dispatch.earliesttime, dispatch.latesttime, actions, action.email, action.email.to, action.email.sendresults, alert.track, alert.expires, alerttype, realtime_schedule

0 Karma
Highlighted

Re: Can't fillnull on fields in REST generated table?

SplunkTrust
SplunkTrust

dispatch.earliest_time isn't null so fillnull has nothing to do:

...  | eval a1 = if(isnull('dispatch.earliest_time'), "null", "not null")

Weirdly, it's zero-length at the same time:

...  | eval a2 = length(tostring('dispatch.earliest_time'))

And it's a string:

... | eval a3 = typeof('dispatch.earliest_time')

As a workaround, you can of course use eval dispatch.earliest_time = if(length('dispatch.earliest_time')=0, 0, 'dispatch.earliest_time').

View solution in original post

Highlighted

Re: Can't fillnull on fields in REST generated table?

Champion

Thanks!!

0 Karma
Highlighted

Re: Can't fillnull on fields in REST generated table?

SplunkTrust
SplunkTrust

If that answers your question please do mark it as accepted.

0 Karma