Splunk eval conditional software#

Suppose that your search has produced the following search results: Fill the specified fields with the string 'unknown' Fill all empty fields with the string 'NULL'įor the current search results, fill all empty field values with the string 'NULL'. You can fill all of empty field values with the zero by adding the fillnull command to your search.Ģ. Your search has produced the following search results: Fill all empty field values with the default value Now all the values display as expected because the test2 field has at least one non-null value.Įxamples 1. This search generates at least one non-null value for each field and shows the expected behavior by setting the null value of the test2 field to the NULL string. This is because the upstream eval command initially set test2 to null, so the field doesn't exist in the schema. The search results display the test2 field, but not the intended NULL value. For example, consider the following search:

If a field doesn't have at least one non-null value in the event set, it's considered a nonexistent field, so downstream commands like the fillnull command can't process it. The reason the test2 field isn't in the results is that there isn't at least one non-null value for the field in the event set. Notice that the test2 field doesn't show up in the results, even though the eval command created it. To ensure downstream processing of fields by the fillnull command, ensure that there is at least one non-null value for the fields in the event set.įor example, consider the following search: In order for a field to exist in the schema, it must have at least one non-null value in the event set.

Splunk eval conditional software#

When no field-list is specified, the fillnull command fits into the dataset processing type.įields in the event set should have at least one non-null valueĭue to the unique behavior of the fillnull command, Splunk software isn't able to distinguish between a null field value and a null field that doesn't exist in the Splunk schema. The fillnull command is a distributable streaming command when a field-list is specified. If you do not specify a value, the default value is applied to the. value Syntax: value= Description: Specify a string value to replace null values. If you do not specify a field list, the value is applied to all fields. If you specify a field that didn't previously exist, the field is created. If you specify a field list, all of the fields in that list are filled in with the value you specify. Description: A space-delimited list of one or more fields.

You can specify a string to fill the null field values or use the default, field value which is zero ( 0 ). You can replace the null values in one or more fields. Use the fillnull command to replace null field values with a string. Null values are field values that are missing in a particular result but present in another result. Replaces null values with a specified value.