Splunk Search

How to detect and fill default value to empty-value field ?

sieutruc
Contributor

Hello,

When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value "" , but i cannot find any efficient method to achieve that.

I tried fillnull function , but it didn't work through. If i do it by hand, like

eval field=case(isnull(field),"",NOT isnull(field),field)

it works, but if there are nearly 100 fields, it's impossible.

So can you suggest me a solution for that ?

Tags (2)
1 Solution

aneeshkjm123
Path Finder

sieutruc
Contributor

as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work

djfang
Explorer

I have the same problem as @sieutruc, posted another question to hopefully get some answers on this.

http://answers.splunk.com/answers/279781/showing-all-fields-in-search-including-empty.html?minQuesti...

0 Karma

Ayn
Legend

What didn't work with fillnull?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...