Documentation > Splunk > Search Reference > fillnull

Search Reference

 


Welcome
Search Overview
Search Commands
Custom Search Commands

fillnull

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.

Contents

fillnull

Synopsis

Replaces null values with a specified value.

Syntax

fillnull [value=string] field-list

Arguments

value
Datatype: <string>
Description: Replaces null values with a user specified value (default 0)


Description

Replaces null values with a user specified value (default 0). Null values are those missing in a particular result, but present for some other result. If a field-list is provided, fillnull is applied to only fields in the given list (including any fields that does not exist at all). Otherwise, applies to all existing fields.

Examples

Example 1: For the current search results, fill all empty fields with NULL.

... | fillnull value=NULL

Example 2: For the current search results, fill all empty field values of "foo" and "bar" with NULL.

... | fillnull value=NULL foo bar

Example 3: For the current search results, fill all empty fields with zero.

... | fillnull

Example 4: Build a time series chart of web events by host and fill all empty fields with NULL.

sourcetype="web" | timechart count by host | fillnull value=NULL
Retrieved from "http://docs.splunk.com/Documentation/Splunk/4.0/SearchReference/Fillnull"

This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.