I have data in below format in Splunk
where I extracted this as Brand,Files,Size.
Now at some places, where size is showing empty, I want to replace them with 0.
I have used | fillnull value 0.
| eval Size=if(isnull(Size), "0", Size)
But still values are showing empty.
I have used below query
index=*** host=*** source=****
| rex field=_raw max_match=0 "(?[a-z]+),(?\w+\-?\d?.*)\,(?\d?.*)"
| table Brand,Size,Files
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <> = mvindex('<>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files | fillnull value=0
and the result i m getting as like below
After using | fillnull value 0,
I am getting 0 for those files which are not there for 2nd,3rd,4th brands.
But not where size is showing empty.
Can anyone help me with this ?
I think you just missing to tell it what is the field you want fillnull to work on.
try|fillnull value=1  
Your dataset dont not have any column name testfield, so they are all null value. After execute this command, your testfield will be filled with 1.
You probably have the fields as not null.
It usually will be a white space.Check whether its whitespace using the following command
If you have white space, replace the if clause as below or use replace command to replace white space to null
| eval Size=if(isnull(Size),"0",if(Size=" ","0",Size))
I tried above suggestions but it did not worked .
Might be because field is string.
I tried to convert it into number using convert but that also not worked.
The problem is that there are 2 different
nullish things in Splunk. One is where the field has
no value and is truly
null. The other is when it has a value, but the value is
empty and is unprintable and zero-length, but not
null. What you need to use to cover all of your bases is this instead:
... | foreach Every Field That Might Be Empty Listed Here [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]
You can test this like this:
|makeresults | eval notNULL="" | fillnull value=0 notNULL
|makeresults | eval notNULL="" | foreach notNULL [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]
Of course, this only works if it is
empty; very occasionally you may find a field with only whitespace in it. For those cases, you can do this:
... | foreach Every Field That Might Be Empty or Have Only Whitespace Listed Here [ rex field=<<FIELD>> mode=sed "s/^[\r\n\s]+$//" | eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]