Search Reference

filldown

Description

Replaces null values with the last non-null value for a field or set of fields. If no list of fields is given, the filldown command will be applied to all fields. If there are not any previous values for a field, it is left blank (NULL).

Syntax

filldown <wc-field-list>

Required arguments

<wc-field-list>

Syntax: <string>, <string>, ...

Description: Comma-delimited list of fields to apply the filldown command to. You can use wild card characters to specify fields with similar names.

Examples

Example 1:

Filldown null values values for all fields.

... | filldown

Example 2:

Filldown null values for the count field only.

... | filldown count

Example 3:

Filldown null values for the count field and any field that starts with 'score'.

... | filldown count score*

See also

fillnull

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the filldown command.