Splunk Search

Replacing blank values with "0"

harshparikhxlrd
Path Finder

Trying to replace the blank values on my dashboard with 0s. If table is empty, should display 0. On the logs data, it is simply blank.

0 Karma
1 Solution

aberkow
Builder

Since you said you tried fillnull, I'm guessing they're being read in as empty strings. For that specific column, you can specifically try

| eval invalid=if(isnull(invalid) OR invalid="", 0, invalid)
Otherwise fillnull value=0 should fill any fields that are null. You can also check if the column is actually null or not by doing this:

| eval isInvalidNull=if(isnull(invalid), 1, 0)
and compute this column just to validate that theory

View solution in original post

0 Karma

aberkow
Builder

Since you said you tried fillnull, I'm guessing they're being read in as empty strings. For that specific column, you can specifically try

| eval invalid=if(isnull(invalid) OR invalid="", 0, invalid)
Otherwise fillnull value=0 should fill any fields that are null. You can also check if the column is actually null or not by doing this:

| eval isInvalidNull=if(isnull(invalid), 1, 0)
and compute this column just to validate that theory

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...