Display table with empty values marked as NONE

[asarolkar]

I have a log file which gives me a list of physicians and insurers.

sourcetype="patientlog" id=1 physician=Kelly,Jack insurer=BCBS
sourcetype="patientlog" id=2 insurer=Medicare
sourcetype="patientlog" id=3 physician=James,Francis 

I want to create a table such that for every patient id I can list the physician and insurer.

id1      physician           insurer
1        Kelly, Jack          BCBS
2           NONE              Medicare
3        James, Francis       NONE

This is a little tricky becaues the way the log is written I cant really write out a "NONE" if I do something like

sourcetype="patientlog" physician=* insurer=* | stats physician, insurer by id

Anybody know a smart way of doing this ? I cant change the log file but I need to display empty values as "NONE" somehow

[aholzer]

You could use the fillnull command

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull

[joshd]

You need to specify the field names after the value="NA" ... ie: sourcetype="patientlog" | fillnull value="NA" physician | table physician, insurer

[asarolkar]

That did not work out 😞

[asarolkar]

sourcetype="patientlog" | fillnull value="NA" | table physician, insurer ?