Splunk Search

Is there any way to use fillnull conditionally

Maniteja81
New Member

I have a requirement, where i need to switch the fillnull value between Excluded and N/A.

So is there any way that i can use fillnull conditionally.

Eg: if (status == "EXCLUDED") then fillnull value="EXCLUDED"
OR
if (status == "N/A") then fillnull value="N/A"

Is this can be done ?

Please help me on this, i really need this kind of behavior in my dashboard.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| eval FIELD_NAME=if(isnull(status),"EXCLUDED",'status')

0 Karma

renjith_nair
Legend

@Maniteja81,
How many fields are you trying to fill the null? If its one field, can't you use the conditional substitution using case or if ? Is it possible to share the search currently using ?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...