Splunk Search

The fillnull_value option in tstats command

lucas4394
Path Finder

According to Splunk document in "tstats" command, the optional argument, fillnull_value, is available for my Splunk version, 7.2; however, this optional argument doesn't seem working at all. I got an error message: "... The argument 'fillnull_value=NA' is invalid". Does anyone have any clues? Thanks.

| tstats summariesonly=true fillnull_value="NA" count from datamodel=Email.All_Email where * by All_Email.src_user
0 Karma

aberkow
Builder

I just played around with it for awhile - I had initially thought it was because you had "count" and that can never return null, but I tried values as well and that yielded nothing either. If no one else can answer, you have the workaround of adding on line 2 | fillnull value="NA", and should probably open a support ticket. Also, there are no examples of it in usage here: https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Tstats#Examples which is a bit bothersome.

0 Karma

rvaglid
Explorer

According to the docs this option to `tstats` were introduced in 8.0.0. 
I just recently discovered myself. 🙂

Cheers,
Rolf

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...