I need to use fillnull command but I don't have the exact field names before hand. All my fields starts (which I want to fill) starts with a common string i.e. err* . Though most of the commands in splunk do work with field name patterns e.g. table err*
but fillnull err*
is not working the way I want. Is there any other way to do this?
As you noticed fillnull
doesn't support wildcards for field names. If you don't supply any field names though, it will be applied to all fields. Unless this messes up something else in your search, that might solve your problems.
Unfortunately that messes something else up. Suppose I offer a hundred services to all of my n clients, but only want to label particular clients with a company name. I want to | fillnull value=0 service_*
. Is there another (easy) method to achieve this?