Splunk Search

Why am I getting strange results with the fillnull command when I input a lookup table?

responsys_cm
Builder

I have a search that looks like:

multisearch [search a] [search b] | table field1, field2, field3 | fillnull value="N/A" | outputlookup lookup_table | tscollect namespace="Foo"

When I input the lookup table, a whole bunch of fields still have null values. If I look at the same data using tstats, those fields have the "N/A" like they are supposed to.

Can anyone explain why this is happening?

Thx.

0 Karma

gcusello
SplunkTrust
SplunkTrust

I had a problem like your and I solved using eval
try this

eval myfield=if(isnull(myfield),"N/A",myfield)

Bye

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...