Splunk Fillnull

Differentiate between ‘usenull’ and ‘fillnull’ commands in Splunk?

splunk

1 answer

Answers

Anthony A

Posted on 19th April 2024

Usenull:

usenull is utilised in charting commands similar timechart else chart for a while you require a series designed for events that do not possess that split-by field.

Fillnull:

fillnull fills entire null values within the results of a particular field/fields/all fields with a value.