In an existing alert I found the following code: ... | fillnull Foo value="bar" | search Foo!=none … It seems that the result of the first line is that Foo always has a value. If that is so, t...
...ount by request.detail.Context
| fillnull value=0 request.detail.Contex
The problem I have is around the zero values and the 'fillnull'. It basically doesn't work.
I've tried shifting the p...
What is the best way to use fillnull for multiple fields? What is the best way to avoid it working for only the first field?
Some examples are:
| fillnull value=NULL field1 field2 field3
| fillnull...
...ields empty and/or are not present. So for example it is required that the field subject is always filled; of course, if subject is not present in events, we have to fill it with a token, like the fillnull...
...ow with all 0s to be displayed anyway. I tried with fillnull value = 0 field, field, field .... but it doesn't work. Also tried fulldown, but nothing. Do you have any suggestions? Thank you
&n...
As I write this I realize that what I want is likely not possible using this method. I want a fillnull (or similar) to happen before an eval. The eval is likely not even called if there a...
Hi, I want to do a fillnull on an eval created field post stats but it never works quite right with either creating the null field in the eval field or just not working at all. What I want is when i...
...ickets with no subsystem, but it has no label (because the subsystem is empty). The search I'm using is index=myIndex | fillnull value="Not Provided" subsystem | chart count(ticket) by subsystem . I h...