Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Using fillnull for multiple fields?
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dannyzen
Explorer
04-21-2018
04:44 PM
What is the best way to use fillnull for multiple fields? What is the best way to avoid it working for only the first field?
Some examples are:
| fillnull value=NULL field1 field2 field3
| fillnull value=NULL field1 | fillnull value=NULL field2 | fillnull value=NULL field3
Thank You
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
04-21-2018
10:31 PM
@dannyzen, I would choose the following above adding separate pipes for each fillnull. Separate pipe means entire record will be used again for the 2nd fillnull and so on. The fillnull command being a streaming command it would make sense to call in a single place.
| fillnull value=NULL field1 field2 field3
However, you can definitely test the actual performance using Job Inspector for both the compare and see the response time for yourself.
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dannyzen
Explorer
04-22-2018
12:38 AM
Thank you
I will group the fields as field1 field2 field3
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ssadanala1
Contributor
04-21-2018
10:36 PM
If wanted to substitute values for null values in all the fields
you can specify |fillnull
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
04-21-2018
10:31 PM
@dannyzen, I would choose the following above adding separate pipes for each fillnull. Separate pipe means entire record will be used again for the 2nd fillnull and so on. The fillnull command being a streaming command it would make sense to call in a single place.
| fillnull value=NULL field1 field2 field3
However, you can definitely test the actual performance using Job Inspector for both the compare and see the response time for yourself.
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
niketn
Legend
04-22-2018
02:35 AM
@dannyzen I have converted comment to Answer. Please accept to mark this question as answered!
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!
Security Professional: Sharpen Your Defenses with These .conf25 Sessions
Sooooooooooo, guess what.
.conf25 is almost here, and if you're on the Security Learning Path, this is your ...
First Steps with Splunk SOAR
Our first step was to gather a list of the playbooks we wanted and to sort them by priority. Once this list ...
How To Build a Self-Service Observability Practice with Splunk Observability Cloud
If you’ve read our previous post on self-service observability, you already know what it is and why it ...
