Fillnull versus !=none ???

[MarcRiese]

In an existing alert I found the following code:

...

| fillnull Foo value="bar"

| search Foo!=none

…

It seems that the result of the first line is that Foo always has a value.

If that is so, then in which case could the second line have any effect? Does it really filters anything out?

It seems that none is a reserved word in Splunk, but I was not able to find any definition of it in the Splunk reference manual.  Any pointers to official Splunk documentation?

[MarcRiese]

Thanks ITWhisperer

[ITWhisperer · Accepted solution]

search is looking for Foo not equal to the string "none" - it doesn't have to be in quotes. Whether this makes sense in the context of your alert, you decide. To test for null, i.e. the field not being present or not, you should use isnull() or isnotnull() functions.