Splunk Search

How to detect and fill default value to empty-value field ?



When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value "" , but i cannot find any efficient method to achieve that.

I tried fillnull function , but it didn't work through. If i do it by hand, like

eval field=case(isnull(field),"",NOT isnull(field),field)

it works, but if there are nearly 100 fields, it's impossible.

So can you suggest me a solution for that ?

Tags (2)
1 Solution

Path Finder


as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work


I have the same problem as @sieutruc, posted another question to hopefully get some answers on this.


0 Karma


What didn't work with fillnull?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...