Splunk Search

How to detect and fill default value to empty-value field ?

sieutruc
Contributor

Hello,

When i did a search on my SQL data, there are a lot of empty-value fields, which don't contain anything, i want to fill them up with value "" , but i cannot find any efficient method to achieve that.

I tried fillnull function , but it didn't work through. If i do it by hand, like

eval field=case(isnull(field),"",NOT isnull(field),field)

it works, but if there are nearly 100 fields, it's impossible.

So can you suggest me a solution for that ?

Tags (2)
1 Solution

aneeshkjm123
Path Finder

sieutruc
Contributor

as i specified in my question, fillnull value=NULL doesn't work. It only works in case there is at least one value of the field is not empty, but if all the value of that field are empty , it doesn't work

djfang
Explorer

I have the same problem as @sieutruc, posted another question to hopefully get some answers on this.

http://answers.splunk.com/answers/279781/showing-all-fields-in-search-including-empty.html?minQuesti...

0 Karma

Ayn
Legend

What didn't work with fillnull?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...