Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to detect and fill default value to empty-valu...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello,
When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value "
I tried fillnull function , but it didn't work through. If i do it by hand, like
eval field=case(isnull(field),"
it works, but if there are nearly 100 fields, it's impossible.
So can you suggest me a solution for that ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try piping it with
fillnull value=NULL
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/fillnull
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
try piping it with
fillnull value=NULL
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/fillnull
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the same problem as @sieutruc, posted another question to hopefully get some answers on this.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What didn't work with fillnull?
Splunk Answers Content Calendar, July Edition I
Secure Your Future: Mastering Upgrade Readiness for Splunk 10
Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM
