Splunk Search

fillnull for all the field names with a pattern

asingla
Communicator

I need to use fillnull command but I don't have the exact field names before hand. All my fields starts (which I want to fill) starts with a common string i.e. err* . Though most of the commands in splunk do work with field name patterns e.g. table err* but fillnull err* is not working the way I want. Is there any other way to do this?

Tags (1)

Ayn
Legend

As you noticed fillnull doesn't support wildcards for field names. If you don't supply any field names though, it will be applied to all fields. Unless this messes up something else in your search, that might solve your problems.

bhawkins1
Communicator

Unfortunately that messes something else up. Suppose I offer a hundred services to all of my n clients, but only want to label particular clients with a company name. I want to | fillnull value=0 service_*. Is there another (easy) method to achieve this?

0 Karma

genesiusj
Builder

@bhawkins1 

Old post; you probably have an answer. I was looking for one and came up with this.

```Set blank_calc for same and not fields for future eval commands.```
| foreach *_same, *_not
    [| fillnull value="blank_calc" <<FIELD>>]

Worked for me.

God bless,
Genesius

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...