https://community.splunk.com/t5/Splunk-Enterprise/Fillnull-value-directly-in-Data-Model/m-p/599872#M12736 <P>Solved by myself: the point is switch from extracted field to a calculated field.&nbsp;</P> Tue, 31 May 2022 10:58:47 GMT SIEMStudent 2022-05-31T10:58:47Z https://community.splunk.com/t5/Splunk-Enterprise/Fillnull-value-directly-in-Data-Model/m-p/599836#M12735 <P>Hi Spunkers, I have a request by customer never faced before.</P><P>For one particular Data Model, the Email one, it is required that certaine filed are always populated, even if the logs have this fields empty and/or are not present. So for example it is required that the field <STRONG>subject</STRONG> is always filled; of course, if subject is not present in events, we have to fill it with a token, like the <STRONG>fillnullvalue</STRONG> function does.</P><P>The particular part is that the customer required that this filling is performed not at search time, with a fillnull command in search, but by the Data Model itself; so, for example, if a log from mail server arrive and it not contain the subject field and/or it is not populated, the DM must fill it with a token value and so, when a search is executed, subject will be already filled with this token.<BR /><BR />My question is: is this possible to perform?</P> Tue, 31 May 2022 08:28:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/Fillnull-value-directly-in-Data-Model/m-p/599836#M12735 SIEMStudent 2022-05-31T08:28:12Z https://community.splunk.com/t5/Splunk-Enterprise/Fillnull-value-directly-in-Data-Model/m-p/599872#M12736 <P>Solved by myself: the point is switch from extracted field to a calculated field.&nbsp;</P> Tue, 31 May 2022 10:58:47 GMT https://community.splunk.com/t5/Splunk-Enterprise/Fillnull-value-directly-in-Data-Model/m-p/599872#M12736 SIEMStudent 2022-05-31T10:58:47Z