Splunk Search

Why am I getting strange results with the fillnull command when I input a lookup table?

responsys_cm
Builder

I have a search that looks like:

multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo"

When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using tstats, those fields have the "N/A" like they are supposed to.

Can anyone explain why this is happening?

Thx.

0 Karma

gcusello
SplunkTrust
SplunkTrust

I had a problem like your and I solved using eval
try this

eval myfield=if(isnull(myfield),"N/A",myfield)

Bye

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...