Splunk Search

Is there any way to use fillnull conditionally

Maniteja81
New Member

I have a requirement, where i need to switch the fillnull value between Excluded and N/A.

So is there any way that i can use fillnull conditionally.

Eg: if (status == "EXCLUDED") then fillnull value="EXCLUDED"
OR
if (status == "N/A") then fillnull value="N/A"

Is this can be done ?

Please help me on this, i really need this kind of behavior in my dashboard.

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Try this

| eval FIELD_NAME=if(isnull(status),"EXCLUDED",'status')

0 Karma

renjith_nair
Legend

@Maniteja81,
How many fields are you trying to fill the null? If its one field, can't you use the conditional substitution using case or if ? Is it possible to share the search currently using ?

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...