I have data in below format in Splunk
where I extracted this as Brand,Files,Size.
Now at some places, where size is showing empty, I want to replace them with 0.
I have used | fillnull value 0.
| eval Size=if(isnull(Size), "0", Size)
But still values are showing empty.
I have used below query
index=*** host=*** source=****
| rex field=_raw max_match=0 "(?[a-z]+),(?\w+\-?\d?.*)\,(?\d?.*)"
| table Brand,Size,Files
| eval _counter = mvrange(0,mvcount(Brand))
| stats list(*) as * by _counter
| foreach * [ eval <> = mvindex('<>' , _counter)]
| xyseries Brand Files Size
| transpose 0 header_field=Brand column_name=Files | fillnull value=0
and the result i m getting as like below
After using | fillnull value 0,
I am getting 0 for those files which are not there for 2nd,3rd,4th brands.
But not where size is showing empty.
Can anyone help me with this ?
The problem is that there are 2 different nullish
things in Splunk. One is where the field has no value
and is truly null
. The other is when it has a value, but the value is ""
or empty
and is unprintable and zero-length, but not null
. What you need to use to cover all of your bases is this instead:
... | foreach Every Field That Might Be Empty Listed Here [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]
You can test this like this:
|makeresults
| eval notNULL=""
| fillnull value=0 notNULL
Versus this:
|makeresults
| eval notNULL=""
| foreach notNULL [ eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]
Of course, this only works if it is empty
; very occasionally you may find a field with only whitespace in it. For those cases, you can do this:
... | foreach Every Field That Might Be Empty or Have Only Whitespace Listed Here [ rex field=<<FIELD>> mode=sed "s/^[\r\n\s]+$//" | eval <<FIELD>> = if(isnull(<<FIELD>>) OR len(<<FIELD>>)==0, "0", <<FIELD>>) ]