
filldown
Description
Replaces null values with the last non-null value for a field or set of fields. If no list of fields is given, the filldown
command will be applied to all fields. If there are not any previous values for a field, it is left blank (NULL).
Syntax
filldown <wc-field-list>
Required arguments
- <wc-field-list>
- Syntax: <string>, <string>, ...
- Description: Comma-delimited list of fields to apply the
filldown
command to. You can use wild card characters to specify fields with similar names.
Examples
Example 1:
Filldown null values values for all fields.
... | filldown
Example 2:
Filldown null values for the count field only.
... | filldown count
Example 3:
Filldown null values for the count field and any field that starts with 'score'.
... | filldown count score*
See also
PREVIOUS fieldsummary |
NEXT fillnull |
This documentation applies to the following versions of Splunk Cloud™: 7.0.13, 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 8.0.2006, 8.0.2007, 8.1.2008, 8.1.2009, 8.1.2011
Feedback submitted, thanks!