Splunk Search

Why am I getting strange results with the fillnull command when I input a lookup table?

responsys_cm
Builder

I have a search that looks like:

multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo"

When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using tstats, those fields have the "N/A" like they are supposed to.

Can anyone explain why this is happening?

Thx.

0 Karma

gcusello
SplunkTrust
SplunkTrust

I had a problem like your and I solved using eval
try this

eval myfield=if(isnull(myfield),"N/A",myfield)

Bye

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Automatic Discovery Part 2: Setup and Best Practices

In Part 1 of this series, we covered what Automatic Discovery is and why it’s critical for observability at ...