Could you please tell us more about the problem you are trying to solve? The tstats command does not have a 'fillnull' option. Recall that tstats works off the tsidx files, which IIRC does not store null values.
According to the Tstats documentation, we can use fillnull_values which takes in a string value. I tired using that, but it didn't work.
Please share your query.
trying to use this
| tstats summariesonly=true allow_old_summaries=true fillnull_value="NULL" count FROM datamodel=Linux_System.Linux_System WHERE (Linux_System.src_host=*) by src_host
Do you have src_host fields with null values?
Yes, it has null values.