Related Answers
Download topic as PDF
filldown
Description
Replaces null values with the last non-null value for a field or set of fields. If no list of fields is given, the filldown command will be applied to all fields. If there are not any previous values for a field, it is left blank (NULL).
Syntax
filldown <wc-field-list>
Required arguments
- <wc-field-list>
- Syntax: <string>, <string>, ...
- Description: Comma-delimited list of fields to apply the
filldowncommand to. You can use wild card characters to specify fields with similar names.
Examples
Example 1:
Filldown null values values for all fields.
... | filldown
Example 2:
Filldown null values for the count field only.
... | filldown count
Example 3:
Filldown null values for the count field and any field that starts with 'score'.
... | filldown count score*
See also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the filldown command.
|
PREVIOUS fieldsummary |
NEXT fillnull |
This documentation applies to the following versions of Splunk Cloud™: 6.6.3, 7.0.0, 7.0.2, 7.0.5, 7.0.3, 7.0.8, 7.0.11, 7.1.3, 7.1.6, 7.2.3, 7.2.4, 7.2.6, 7.2.7
Comments
The wc-field-list description appears to be for the "fields" command, not the "filldown" command.
DaveWood
Thank you for pointing this out! I have updated the description.