Null value for each column data

[jhayIV]

Is there a way I can use the foreach function to create a variables that will give me a 1 value for each null value ?

Here is how I would do it for cores: eval nullcores=if(isnull(Cores),1,0)

index=#### sourcetype=#### | Table Name,Cores,DNS_Host_Name,Domain,IsVirtual,NumberOfProcessors,OS,Owner_Contact,ProdCat1,ProdCat2,ProdCat3,Region,Serial_Number,Site,SiteGroup,SystemRole,SystemStatus,Total_Managedby,Total_Ownedby,Total_Patchedby,Total_Physical_Memory,Total_Applications|

[DalJeanis]

Yes, you can do that easily - some methods are after the bar -- but the question you are asking indicates you are probably trying to overcomplicate your life.

Please step back and describe your use case. What information are you trying to create, and what will you do with that information?

---

Use this if you want one field per field...

  | foreach (your list of fields)  [eval null<<field>>=if(isnull(<<field>>),1,0)"]

Use this if you want one field total...

  | eval addupnulls=0
  | foreach (your list of fields)  [eval addupnulls=addupnulls+if(isnull(<<field>>),1,0)"]

[richgalloway]

Expanding on your example gets a foreach command like this.

index=#### sourcetype=#### | foreach * [eval null<<FIELD>>=if(isnull(<<FIELD>>),1,0)] | table Name,Cores,DNS_Host_Name,Domain,IsVirtual,NumberOfProcessors,OS,Owner_Contact,ProdCat1,ProdCat2,ProdCat3,Region,Serial_Number,Site,SiteGroup,SystemRole,SystemStatus,Total_Managedby,Total_Ownedby,Total_Patchedby,Total_Physical_Memory,Total_Applications null*

[somesoni2]

You can try fillnull command like this

index=#### sourcetype=#### | table Name,Cores,DNS_Host_Name,Domain,IsVirtual,NumberOfProcessors,OS,Owner_Contact, ProdCat1,ProdCat2,ProdCat3,Region,Serial_Number,Site,SiteGroup,SystemRole,SystemStatus, Total_Managedby,Total_Ownedby,Total_Patchedby,Total_Physical_Memory,Total_Applications | fillnull value=1

OR foreach command like this

index=#### sourcetype=#### | table Name,Cores,DNS_Host_Name,Domain,IsVirtual,NumberOfProcessors,OS,Owner_Contact, ProdCat1,ProdCat2,ProdCat3,Region,Serial_Number,Site,SiteGroup,SystemRole,SystemStatus, Total_Managedby,Total_Ownedby,Total_Patchedby,Total_Physical_Memory,Total_Applications | foreach * [eval <<FIELD>>=coalesce(<<FIELD>>,1)]