Splunk Search

Stats list removes empty strings in the search GUI

Motivator
| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="" | stats list(a)

vs.

| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="0" | stats list(a)

... shows only one result, even though

| makeresults | eval a="1" | append [| makeresults | eval b="2"] | fillnull value="" | stats list(a) AS z | eval w=mvcount(z) | table w

... counts 2. Isn't this the whole point of using fillnull? What's the most elegant workaround? This seems to be super dangerous and misleading

0 Karma

Motivator

Per @dmarling a workaround to this bug is to fillnull with alt+255

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!