Splunk Search

how toreplace all the existing blank fields values with some name using replace command

vrmandadi
Builder

I have data coming from a csv file .it has almost 30 fields and some of it values are blank.How I replace the empty fields or no value fields for all the fields with some value

I tried using
| replace "" WITH "abc" IN * but it does not work .If i give a field name then it works . I tried using fillnull command but that did not work

0 Karma

vnravikumar
Champion

Hi

Try this

| makeresults 
| eval field1="a",field2="",field3="3",field4="b" 
| append 
    [| makeresults 
    | eval field1="",field2="",field3="",field4="b"] 
| replace "" with "NA"
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...