FAQ: How do I set a default field value?

To set a default field value in LogScale similar to how you might use fillnull in Splunk, use default() and select().

In the following example, the field GrandParentBaseFilename is blank, and we want to set it to the value Unknown:

#event_simpleName=ProcessRollup2
| default(field=GrandParentBaseFileName, value="Unknown")
| select([GrandParentBaseFileName, ParentBaseFileName, ImageFileName])