Splunk Search

Display table with empty values marked as NONE


I have a log file which gives me a list of physicians and insurers.

sourcetype="patientlog" id=1 physician=Kelly,Jack insurer=BCBS
sourcetype="patientlog" id=2 insurer=Medicare
sourcetype="patientlog" id=3 physician=James,Francis 

I want to create a table such that for every patient id I can list the physician and insurer.

id1      physician           insurer
1        Kelly, Jack          BCBS
2           NONE              Medicare
3        James, Francis       NONE

This is a little tricky becaues the way the log is written I cant really write out a "NONE" if I do something like

sourcetype="patientlog" physician=* insurer=* | stats physician, insurer by id

Anybody know a smart way of doing this ? I cant change the log file but I need to display empty values as "NONE" somehow

0 Karma



You need to specify the field names after the value="NA" ... ie: sourcetype="patientlog" | fillnull value="NA" physician | table physician, insurer


That did not work out 😞

0 Karma


sourcetype="patientlog" | fillnull value="NA" | table physician, insurer ?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!