Splunk Search

Fulfill empty table entries

zugji
Path Finder

Is there a way I can fulfill empty tables.
name="*" | chart count by name,severity | rename 1 as alert, 2 as critical, 3 as error, 4 as warn, 5 as notice, 6 as info | table name,alert,critical,error,warn,notice,info | sort - alert,critical,error,warn,notice,info | head 20

This gives a table back with empty fields. Is there a way I can fulfill empty fields with 0?

Example:

name alert critical error warn notice info
t1                   2     1    1      0
t2                   1     1    0      0

Expectation:

name alert critical error warn notice info
t1   0     0         2     1    1      0
t2   0     0         1     1    0      0

Regards,
Christian

Tags (3)
1 Solution

kristian_kolb
Ultra Champion

You should have a look at the fillnull command.

...| fillnull alert critical | ...

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull

Hope this helps,

Kristian

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

You should have a look at the fillnull command.

...| fillnull alert critical | ...

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Fillnull

Hope this helps,

Kristian

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...