Splunk Search

how toreplace all the existing blank fields values with some name using replace command

vrmandadi
Builder

I have data coming from a csv file .it has almost 30 fields and some of it values are blank.How I replace the empty fields or no value fields for all the fields with some value

I tried using
| replace "" WITH "abc" IN * but it does not work .If i give a field name then it works . I tried using fillnull command but that did not work

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval field1="a",field2="",field3="3",field4="b" 
| append 
    [| makeresults 
    | eval field1="",field2="",field3="",field4="b"] 
| replace "" with "NA"
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...