Splunk Search

Using fillnull for multiple fields?

dannyzen
Explorer

What is the best way to use fillnull for multiple fields? What is the best way to avoid it working for only the first field?
Some examples are:
| fillnull value=NULL field1 field2 field3
| fillnull value=NULL field1 | fillnull value=NULL field2 | fillnull value=NULL field3

Thank You

0 Karma
1 Solution

niketn
Legend

@dannyzen, I would choose the following above adding separate pipes for each fillnull. Separate pipe means entire record will be used again for the 2nd fillnull and so on. The fillnull command being a streaming command it would make sense to call in a single place.

| fillnull value=NULL field1 field2 field3

However, you can definitely test the actual performance using Job Inspector for both the compare and see the response time for yourself.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

dannyzen
Explorer

Thank you
I will group the fields as field1 field2 field3

0 Karma

ssadanala1
Contributor

If wanted to substitute values for null values in all the fields
you can specify |fillnull

0 Karma

niketn
Legend

@dannyzen, I would choose the following above adding separate pipes for each fillnull. Separate pipe means entire record will be used again for the 2nd fillnull and so on. The fillnull command being a streaming command it would make sense to call in a single place.

| fillnull value=NULL field1 field2 field3

However, you can definitely test the actual performance using Job Inspector for both the compare and see the response time for yourself.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

niketn
Legend

@dannyzen I have converted comment to Answer. Please accept to mark this question as answered!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...