Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Use fillnull to fill in different values within sa...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi All,
I am trying to use the fillnull to populate empty values within the same field with unique values. For example, the first empty value found in field1, insert unknown1. The second empty value found in field1, insert unknown2, etc...
Any suggestions?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming all the events have a null, or you just need them to be unique (not sequential) try this:
|streamstats count as ct|eval yourNullField=if(isnull(yourNullField),"Unknown "+ct,yourNullField)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assuming all the events have a null, or you just need them to be unique (not sequential) try this:
|streamstats count as ct|eval yourNullField=if(isnull(yourNullField),"Unknown "+ct,yourNullField)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you for your reply.
What that did was fill in the empty values all the same with "Unknown" and "# of events" for a particular field. Example: Within MyField1 all empty values show "Unknown 500". What I am trying to do is increment the value so all the empty values in MyField1 are unique.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry - use streamstats, not event stats.
edited answer
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That works, thank you!! I appreciate the quick response.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
