Splunk Search

what is the difference between 'usenull' and 'fillnull' command in splunk?

aarthirajaraman
Engager

I want to know what is the difference between usenull and fillnull command in the splunk? can anyone help me with it to get a clear idea about it?

cmerriman
Super Champion

fillnull fills all the null values in the results of a specific field/fields/all fields with a value (defaulted as 0)
https://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Fillnull

|fillnull FIELD value="N/A"

usenull is used in charting commands like timechart or chart for when you want a series created for events that don't have the split-by field.
http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Chart

|chart count by FIELD usenull=t nullstr="N/A"

youngso
SplunkTrust
SplunkTrust

"sourcetype=access_* status=200 action=purchase | chart dc(clientip) OVER date_hour BY categoryId usenull=f

This search takes the purchase events and pipes it into the chart command. The dc() or distinct_count() function is used to count the number of unique visitors (characterized by the clientip field). This number is then charted over each hour of the day and broken out based on the category_id of the purchase. Also, because these are numeric values, the search uses the usenull=f argument to exclude fields that don't have a value."

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...