fillnull
fillnull
Synopsis
Replaces null values with a specified value.
Syntax
fillnull [value=string] <field-list>
Required arguments
- field-list
- Syntax: <field>...
- Description: One or more fields, delimited with a space. If not specified, fillnull is applied to all fields.
Optional arguments
- value
- Datatype: <string>
- Description: Replaces null values with a user specified value (default 0)
Description
Replaces null values with a user specified value (default 0). Null values are those missing in a particular result, but present for some other result. If a field-list is provided, fillnull is applied to only fields in the given list (including any fields that does not exist at all). Otherwise, applies to all existing fields.
Examples
Example 1: For the current search results, fill all empty fields with NULL.
... | fillnull value=NULLExample 2: For the current search results, fill all empty field values of "foo" and "bar" with NULL.
... | fillnull value=NULL foo barExample 3: For the current search results, fill all empty fields with zero.
... | fillnullExample 4: Build a time series chart of web events by host and fill all empty fields with NULL.
sourcetype="web" | timechart count by host | fillnull value=NULLSee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the fillnull command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.
It seems that using the fillnull command prevents you from being able to drilldown, is there any way around this?