fillnull for all the field names with a pattern

[asingla]

I need to use fillnull command but I don't have the exact field names before hand. All my fields starts (which I want to fill) starts with a common string i.e. err* . Though most of the commands in splunk do work with field name patterns e.g. table err* but fillnull err* is not working the way I want. Is there any other way to do this?

[Ayn]

As you noticed fillnull doesn't support wildcards for field names. If you don't supply any field names though, it will be applied to all fields. Unless this messes up something else in your search, that might solve your problems.

[bhawkins1]

Unfortunately that messes something else up. Suppose I offer a hundred services to all of my n clients, but only want to label particular clients with a company name. I want to | fillnull value=0 service_*. Is there another (easy) method to achieve this?

[genesiusj]

@bhawkins1 

Old post; you probably have an answer. I was looking for one and came up with this.

```Set blank_calc for same and not fields for future eval commands.```
| foreach *_same, *_not
    [| fillnull value="blank_calc" <<FIELD>>]

Worked for me.

God bless,
Genesius