Splunk Search

Fillnull versus !=none ???

MarcRiese
Explorer

In an existing alert I found the following code:

...

| fillnull Foo value="bar"

| search Foo!=none

It seems that the result of the first line is that Foo always has a value.

If that is so, then in which case could the second line have any effect? Does it really filters anything out?

It seems that none is a reserved word in Splunk, but I was not able to find any definition of it in the Splunk reference manual.  Any pointers to official Splunk documentation?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

View solution in original post

0 Karma

MarcRiese
Explorer

Thanks ITWhisperer

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...