Splunk Search

Fillnull versus !=none ???

MarcRiese
Explorer

In an existing alert I found the following code:

...

| fillnull Foo value="bar"

| search Foo!=none

It seems that the result of the first line is that Foo always has a value.

If that is so, then in which case could the second line have any effect? Does it really filters anything out?

It seems that none is a reserved word in Splunk, but I was not able to find any definition of it in the Splunk reference manual.  Any pointers to official Splunk documentation?

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

View solution in original post

0 Karma

MarcRiese
Explorer

Thanks ITWhisperer

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...