fillnull
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10
Contents
fillnull
Synopsis
Replaces null values with a specified value.
Syntax
fillnull [value=string] field-list
Arguments
- value
- Datatype: <string>
- Description: Replaces null values with a user specified value (default 0)
Description
Replaces null values with a user specified value (default 0). Null values are those missing in a particular result, but present for some other result. If a field-list is provided, fillnull is applied to only fields in the given list (including any fields that does not exist at all). Otherwise, applies to all existing fields.
Examples
Example 1: For the current search results, fill all empty fields with NULL.
... | fillnull value=NULL
Example 2: For the current search results, fill all empty field values of "foo" and "bar" with NULL.
... | fillnull value=NULL foo barExample 3: For the current search results, fill all empty fields with zero.
... | fillnullExample 4: Build a time series chart of web events by host and fill all empty fields with NULL.
sourcetype="web" | timechart count by host | fillnull value=NULL