Splunk Search
Highlighted

how toreplace all the existing blank fields values with some name using replace command

Builder

I have data coming from a csv file .it has almost 30 fields and some of it values are blank.How I replace the empty fields or no value fields for all the fields with some value

I tried using
| replace "" WITH "abc" IN * but it does not work .If i give a field name then it works . I tried using fillnull command but that did not work

0 Karma
Highlighted

Re: how toreplace all the existing blank fields values with some name using replace command

Champion

Hi

Try this

| makeresults 
| eval field1="a",field2="",field3="3",field4="b" 
| append 
    [| makeresults 
    | eval field1="",field2="",field3="",field4="b"] 
| replace "" with "NA"
0 Karma