XML Tree has null values, using "table" command. How to fillnull values with a value (like "not_defined")

[ayenumula]

My XML tree has null values for certain fields. I am using "table" command to display fields in a tabular format. I am having difficulty to fill null values with a value (like "not_defined"). The "fillnull" command doesn't work because it just display one single fillnull value for the entire column. My event has 4 different values for the same field.

Current query:
index=ilo sourcetype=test | search RIMP.INFRA2.ENCL=-po- | table RIMP.INFRA2.ENCL, RIMP.INFRA2.BLADES.BLADE.NAME, "RIMP.INFRA2.BLADES.BAYS.BAY{@NAME}", RIMP.INFRA2.BLADES.BLADE.SPN | sort RIMP.INFRA2.ENCL

Each enclosure has 4 blades: 1st column =enclosure, 2nd column=blade name, 3rd column=blade type

Current Output:

RIMP.INFRA2.ENCL - RIMP.INFRA2.BLADES.BLADE.NAME - RIMP.INFRA2.BLADES.BLADE.SPN

ccpesx-po-a1-p - ccpesx-po-e001-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e002-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e003-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e004-p.po.splunk.com - ProLiant BL460c Gen8

ccpesx-po-a2-p - - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8

Expected output:
RIMP.INFRA2.ENCL - RIMP.INFRA2.BLADES.BLADE.NAME - RIMP.INFRA2.BLADES.BLADE.SPN

ccpesx-po-a1-p - ccpesx-po-e001-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e002-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e003-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e004-p.po.splunk.com - ProLiant BL460c Gen8

ccpesx-po-a2-p - not_defined - ProLiant BL460c Gen8
- not_defined - ProLiant BL460c Gen8
- not_defined - ProLiant BL460c Gen8
- not_defined - ProLiant BL460c Gen8

[masonmorales]

I'm not sure I understand your question entirely, because it seems like the fillnull command should produce that output. If this doesn't help, could you post some of the raw data for us to test with?

index=ilo sourcetype=test | search RIMP.INFRA2.ENCL=-po- | fillnull value="not_defined" |  table RIMP.INFRA2.ENCL, RIMP.INFRA2.BLADES.BLADE.NAME, "RIMP.INFRA2.BLADES.BAYS.BAY{@NAME}", RIMP.INFRA2.BLADES.BLADE.SPN | sort RIMP.INFRA2.ENCL

[ayenumula]

I tried | fillnull value="not_defined". It doesn't work for a table. The output I got then is below. "not_defined" value comes up only for one row and not for every row.

RIMP.INFRA2.ENCL - RIMP.INFRA2.BLADES.BLADE.NAME - RIMP.INFRA2.BLADES.BLADE.SPN

ccpesx-po-a1-p - ccpesx-po-e001-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e002-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e003-p.po.splunk.com - ProLiant BL460c Gen8
- ccpesx-po-e004-p.po.splunk.com - ProLiant BL460c Gen8

ccpesx-po-a2-p - not_defined - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8
- - ProLiant BL460c Gen8

[ayenumula]

Mason,
Example XML file:

<RIMP>
    <INFRA2>
        <ENCL>
            <encl_name>ccpesx-po-a1</encl_name>
        </ENCL>
        <blade>
            <name>abc1</name>
            <version>123</version>
            <ip>1.2.3.4</ip>
        </blade>
        <blade>
            <name>abc2</name>
            <version>123</version>
            <ip>1.2.3.5</ip>
        </blade>
        <blade>
            <name></name>
            <version></version>
            <ip>1.2.3.6</ip>
        </blade>
        <blade>
            <name></name>
            <version></version>
            <ip>1.2.3.7</ip>
        </blade>
    </INFRA2>
</RIMP>

[ayenumula]

This is the output when fillnull is used and piped to table:

RIMP.server.name    RIMP.server.version RIMP.server.ip
abc1            123         1.2.3.4
abc2            123         1.2.3.5
            not_defined     1.2.3.6
abc4                        1.2.3.7
abc5                        1.2.3.8

not_defined only populating for one entry and not for all entries..