fillnull - Splunk Documentation (2024)

Table of Contents
Description Syntax Required arguments Optional arguments Usage Fields in the event set should have at least one non-null value Examples 1. Fill all empty field values with the default value 2. Fill all empty fields with the string "NULL" 3. Fill the specified fields with the string "unknown" 4. Use the fillnull command with the timechart command See also FAQs

Description

Replaces null values with a specified value. Null values are field values that are missing in a particular result but present in another result. Use the fillnull command to replace null field values with a string. You can replace the null values in one or more fields. You can specify a string to fill the null field values or use the default, field value which is zero ( 0 ).​

Syntax

The required syntax is in bold.​

fillnull
[value=<string>]
[<field-list>]

Required arguments

None.​

Optional arguments

field-list
Syntax: <field>...
Description: A space-delimited list of one or more fields. If you specify a field list, all of the fields in that list are filled in with the value you specify. If you specify a field that didn't previously exist, the field is created. If you do not specify a field list, the value is applied to all fields.
value
Syntax: value=<string>
Description: Specify a string value to replace null values. If you do not specify a value, the default value is applied to the <field-list>.
Default: 0

Usage

The fillnull command is a distributable streaming command when a field-list is specified. When no field-list is specified, the fillnull command fits into the dataset processing type. See Command types.

Fields in the event set should have at least one non-null value

Due to the unique behavior of the fillnull command, Splunk software isn't able to distinguish between a null field value and a null field that doesn't exist in the Splunk schema. In order for a field to exist in the schema, it must have at least one non-null value in the event set. To ensure downstream processing of fields by the fillnull command, ensure that there is at least one non-null value for the fields in the event set.

For example, consider the following search:

See Also
Comparison and Conditional functions - Splunk DocumentationInformational functions - Splunk DocumentationComparison and Conditional functions - Splunk DocumentationSplunk Cheat Sheet: Query, SPL, RegEx, & Commands | Splunk

| makeresults| eval test="123123", test2=null()| fillnull value=NULL

The results look something like this:

_timetest
2023-06-07 17:49:45123123

Notice that the test2 field doesn't show up in the results, even though the eval command created it. The reason the test2 field isn't in the results is that there isn't at least one non-null value for the field in the event set.

If a field doesn't have at least one non-null value in the event set, it's considered a nonexistent field, so downstream commands like the fillnull command can't process it. For example, consider the following search:

| makeresults | eval test="123123" | eval test2=null() | table test test2 | fillnull value=NULL

The results look something like this:

testtest2
123123

The search results display the test2 field, but not the intended NULL value. This is because the upstream eval command initially set test2 to null, so the field doesn't exist in the schema.

Now consider the following search:

| makeresults | eval test1=split("123,456", ",") | mvexpand test1 | eval test2=if(test1="123", null(), "abc") | fillnull value=NULL

See Also
Informational functions - Splunk Documentation

The results look something like this:

_timetest1test2
2023-06-07 18:22:24123NULL
2023-06-07 18:22:24456abc

This search generates at least one non-null value for each field and shows the expected behavior by setting the null value of the test2 field to the NULL string. Now all the values display as expected because the test2 field has at least one non-null value.

Examples

1. Fill all empty field values with the default value

​Your search has produced the following search results:​

_timeACCESSORIESARCADESHOOTERSIMULATIONSPORTSSTRATEGYTEE
2021-03-1751763532
2021-03-166339302212756
2021-03-156594384212860

​You can fill all of empty field values with the zero by adding the fillnull command to your search.​

... | fillnull

​The search results will look like this:​

_timeACCESSORIESARCADESHOOTERSIMULATIONSPORTSSTRATEGYTEE
2021-03-17517635320
2021-03-1606339302212756
2021-03-1565943842012860

2. Fill all empty fields with the string "NULL"

For the current search results, fill all empty field values with the string "NULL".

... | fillnull value=NULL

3. Fill the specified fields with the string "unknown"

​Suppose that your search has produced the following search results:​

_timehostaverage_kbpsinstanenous_kbpskbps
2021/02/14 12:00danube.sample.com1.8653.420
2021/02/14 11:53mekong.buttercupgames.com0.7100.1641.256
2021/02/14 11:47danube.sample.com1.3252.230
2021/02/14 11:42yangtze.buttercupgames.com2.2490.0002.249
2021/02/14 11:392.8743.8411.906
2021/02/14 11:33nile.example.net2.0230.915

​You can fill all empty field values in the "host" and "kbps" fields with the string "unknown" by adding the fillnull command to your search.​

... | fillnull value=unknown host kbps

​​The results look like this:

_timehostaverage_kbpsinstanenous_kbpskbps
2021/02/14 12:00danube.sample.com1.8653.420
2021/02/14 11:53mekong.buttercupgames.com0.7100.1641.256
2021/02/14 11:47danube.sample.com1.3252.230
2021/02/14 11:42yangtze.buttercupgames.com2.2490.0002.249
2021/02/14 11:39unknown2.8743.8411.906
2021/02/14 11:33nile.example.net2.0230.915unknown

​​If you specify a field that does not exist the field is created and the value you specify is added to the new field. ​For example if you specify bytes in the field list, the bytes field is created and filled with the string "unknown". ​

... | fillnull value=unknown host kbps bytes

​​The results look like this:

_timehostaverage_kbpsinstanenous_kbpskbpsbytes
2021/02/14 12:00danube.sample.com1.8653.420unknown
2021/02/14 11:53mekong.buttercupgames.com0.7100.1641.256unknown
2021/02/14 11:47danube.sample.com1.3252.230unknown
2021/02/14 11:42yangtze.buttercupgames.com2.2490.0002.249unknown
2021/02/14 11:39unknown2.8743.8411.906unknown
2021/02/14 11:33nile.example.net2.0230.915unknownunknown

4. Use the fillnull command with the timechart command

Build a time series chart of web events by host and fill all empty fields with the string "NULL".

sourcetype="web" | timechart count by host | fillnull value=NULL

​

See also

Related commands
filldown
streamstats
fillnull - Splunk Documentation (2024)

FAQs

What does fillnull do in Splunk? ›

The fillnull command replaces null values in all fields with a zero by default.

Know More ›
What is usenull in Splunk? ›

From the docs (https://docs.splunk.com/Documentation/Splunk/7.2.6/SearchReference/ListOfDataTypes): usenull controls whether or not a series is created for events that do not contain the split-by field. This series is labeled by the value of the nullstr option, and defaults to NULL.

Read More ›
Which command is used to remove empty null field values from the Splunk search results? ›

"the search uses the usenull=f argument to exclude fields that don't have a value. "

Read More ›
What does coalesce do in Splunk? ›

The Splunk Search Processing Language (SPL) coalesce function takes one or more values and returns the first value that is not null.

Read More ›
How to improve Splunk performance? ›

Target your search to a narrow dataset

Limit the timeframe of your search to 15 minutes or less. Reduce the amount of data the Splunk platform needs to search through by specifying specific index names in your searches. Typically, you want to store like data that is commonly searched together in the same index.

See Details ›
What are the three default roles in Splunk? ›

The predefined roles are: admin : This role has the most capabilities. power : This role can edit all shared objects and alerts, tag events, and other similar tasks. user : This role can create and edit its own saved searches, run searches, edit preferences, create and edit event types, and other similar tasks.

Learn More Now ›
How do I check if a field is not null in Splunk? ›

To determine if a field is or isn't null, use the isnull() or isnotnull() function.

Read More ›
How to reindex data in Splunk? ›

To reindex your data, perform the following tasks in Splunk SOAR:
  1. From the main menu, select Administration.
  2. Select Administration Settings.
  3. Select Search Settings.
  4. In the Reindex Search Data section, select an information section from the Section to Reindex drop-down list.
  5. Select Reindex.
Mar 5, 2024

Show Me More ›
How to count null values in Splunk? ›

In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field. Is there a way to rename the NULL to display something else? In your search use the fillnull command and assign a value to that field when it is null, then count that value for the field.

Continue Reading ›
How do I remove null data? ›

2. How to treat null values:
  1. You can drop the missing values with the code df. drop() . This will drop all the rows which contain the missing value.
  2. You can fill the missing values with the code df. fillna(0) . You should specify what you want to fill in place of missing values. In the code, I have filled with zero.

Get More Info Here ›

How do I remove empty events in Splunk? ›

In order to remove events from the search result when field is empty you could just add field=* to your search. field=* means "field is anything but empty".

Read On ›
How to filter null values in Splunk? ›

use |where isnull(Device) to get all events where Device is null and |where isnotnull(Device) or |search Device=* / index=A Device=* to get all events where Device is not null.

Find Out More ›
What is rex in Splunk? ›

The rex command matches the value of the specified field against the unanchored regular expression and extracts the named groups into fields of the corresponding names. When mode=sed , the given sed expression used to replace or substitute characters is applied to the value of the chosen field.

Read The Full Story ›
What is the Ceil function in Splunk? ›

ceil(value)

Mathematical evaluation function that rounds a number up to the next highest integer. Returns the result as a double. Use this scalar function with the eval or the filter streaming functions. Numbers can be type int, long, float, or double.

Know More ›
What is spath in Splunk? ›

What is the Splunk spath Command? The spath command extracts fields and their values from either XML or JSON data. You can specify location paths or allow spath to run in its native form.

Discover More ›
How to monitor user activity in Splunk? ›

You can audit user activity in Splunk UBA by reviewing the audit logs in Splunk UBA or by sending audit logs to the Splunk platform for analysis.

Know More ›
What is the use of addon in Splunk? ›

add-on. A type of app that runs on the Splunk platform and provides specific capabilities to other apps, such as getting data in, mapping data, or providing saved searches and macros. An add-on is not typically run as a standalone app.

Find Out More ›
What is an appendpipe in Splunk? ›

Unlike other commands that use a subsearch, the appendpipe command does not run a new query. Instead, it applies the commands in the subpipeline to the existing result set and creates new "rows" with the output.

Discover More Details ›
Top Articles
Healthy Buckeye Balls Recipe (Made with 3-Ingredients) Recipe
Low Carb Keto Milk Chocolate Recipe
Simple script creator
Stiftung Warentest: Das sind die besten Smartphones
fort myers cars & trucks - by owner "cars" - craigslist
fort myers cars & trucks - by owner "cars for sale" - craigslist
Popular P. F. Chang's Menu Items, Ranked Worst To Best - Mashed
PF Chang’s Menu Prices 2024 - Updated | Real Menu With Prices
Nearest Head Shop From My Location
Ffxiv Hippogryph Sinew
Spn 605 Fmi 5 2016 Freightliner
Derail Valley Mod
Latest Posts
Banana Cinnamon Rolls (No Dehydrator!) | 3-Ingredient Vegan Recipe
Traditional Irish Brown Bread Recipe – The Bossy Kitchen
Article information

Author: Melvina Ondricka

Last Updated:

Views: 5940

Rating: 4.8 / 5 (68 voted)

Reviews: 91% of readers found this page helpful

Author information

Name: Melvina Ondricka

Birthday: 2000-12-23

Address: Suite 382 139 Shaniqua Locks, Paulaborough, UT 90498

Phone: +636383657021

Job: Dynamic Government Specialist

Hobby: Kite flying, Watching movies, Knitting, Model building, Reading, Wood carving, Paintball

Introduction: My name is Melvina Ondricka, I am a helpful, fancy, friendly, innocent, outstanding, courageous, thoughtful person who loves writing and wants to share my knowledge and understanding with you.