Splunk Search

Fillnull versus !=none ???

MarcRiese
Explorer

In an existing alert I found the following code:

...

| fillnull Foo value="bar"

| search Foo!=none

It seems that the result of the first line is that Foo always has a value.

If that is so, then in which case could the second line have any effect? Does it really filters anything out?

It seems that none is a reserved word in Splunk, but I was not able to find any definition of it in the Splunk reference manual.  Any pointers to official Splunk documentation?

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

View solution in original post

0 Karma

MarcRiese
Explorer

Thanks ITWhisperer

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...