Splunk Search

How to detect and fill default value to empty-value field ?

sieutruc
Contributor

Hello,

When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value "" , but i cannot find any efficient method to achieve that.

I tried fillnull function , but it didn't work through. If i do it by hand, like

eval field=case(isnull(field),"",NOT isnull(field),field)

it works, but if there are nearly 100 fields, it's impossible.

So can you suggest me a solution for that ?

Tags (2)
1 Solution

aneeshkjm123
Path Finder

sieutruc
Contributor

as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work

djfang
Explorer

I have the same problem as @sieutruc, posted another question to hopefully get some answers on this.

http://answers.splunk.com/answers/279781/showing-all-fields-in-search-including-empty.html?minQuesti...

0 Karma

Ayn
Legend

What didn't work with fillnull?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...