Splunk Search

Fillnull versus !=none ???

MarcRiese
Explorer

In an existing alert I found the following code:

...

| fillnull Foo value="bar"

| search Foo!=none

It seems that the result of the first line is that Foo always has a value.

If that is so, then in which case could the second line have any effect? Does it really filters anything out?

It seems that none is a reserved word in Splunk, but I was not able to find any definition of it in the Splunk reference manual.  Any pointers to official Splunk documentation?

Labels (1)
Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

View solution in original post

0 Karma

MarcRiese
Explorer

Thanks ITWhisperer

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...