Splunk Search

Display table with empty values marked as NONE

asarolkar
Builder

I have a log file which gives me a list of physicians and insurers.

sourcetype="patientlog" id=1 physician=Kelly,Jack insurer=BCBS
sourcetype="patientlog" id=2 insurer=Medicare
sourcetype="patientlog" id=3 physician=James,Francis 

I want to create a table such that for every patient id I can list the physician and insurer.

id1      physician           insurer
1        Kelly, Jack          BCBS
2           NONE              Medicare
3        James, Francis       NONE

This is a little tricky becaues the way the log is written I cant really write out a "NONE" if I do something like

sourcetype="patientlog" physician=* insurer=* | stats physician, insurer by id

Anybody know a smart way of doing this ? I cant change the log file but I need to display empty values as "NONE" somehow

0 Karma

aholzer
Motivator

joshd
Builder

You need to specify the field names after the value="NA" ... ie: sourcetype="patientlog" | fillnull value="NA" physician | table physician, insurer

asarolkar
Builder

That did not work out 😞

0 Karma

asarolkar
Builder

sourcetype="patientlog" | fillnull value="NA" | table physician, insurer ?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...