<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Log Date when Report/Query adds new values in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633702#M108488</link>
    <description>&lt;P&gt;Is not updating the null fields with this command.&lt;BR /&gt;Any idea of what I could be doing wrong?&lt;/P&gt;</description>
    <pubDate>Wed, 08 Mar 2023 10:34:24 GMT</pubDate>
    <dc:creator>PTC_</dc:creator>
    <dc:date>2023-03-08T10:34:24Z</dc:date>
    <item>
      <title>How to log date when report/query adds new values?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633608#M108476</link>
      <description>&lt;P&gt;I have created a Report with a Query that updates a list of NAMES on CSV file.&lt;BR /&gt;If the NAMES field have empty strings or null values, the Query will try to get the NAME from another field and add it to NAMES. Something like this:&lt;/P&gt;
&lt;TABLE border="1" width="99.93064271816276%"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;NAMES&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;ADDED_ON_INDEX&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;REPORT_UPDATE_DATE&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;Sara&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;01/03/2023 00:00:00&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;John&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;01/02/2023 00:00:00&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;Peter&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;01/01/2023 00:00:00&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;Oliver&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;01/03/2023 00:00:00&lt;/TD&gt;
&lt;TD width="33.333333333333336%" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I want to achieve the following:&lt;/P&gt;
&lt;TABLE border="1" width="561px"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;NAMES&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;ADDED_ON_INDEX&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;REPORT_UPDATE_DATE&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;Sara&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;01/03/2023 00:00:00&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;John&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;01/02/2023 00:00:00&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;Peter&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;01/01/2023 00:00:00&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;&lt;STRONG&gt;Matt&lt;/STRONG&gt;&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;&lt;STRONG&gt;22/01/2023 00:00:00&lt;/STRONG&gt;&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;&lt;STRONG&gt;07/03/2023 18:33:09&lt;/STRONG&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="186.2px" height="24px"&gt;Oliver&lt;/TD&gt;
&lt;TD width="186.75px" height="24px"&gt;01/03/2023 00:00:00&lt;/TD&gt;
&lt;TD width="187.25px" height="24px"&gt;&lt;SPAN&gt;06/03/2023 17:28:17&lt;/SPAN&gt;&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;
&lt;P&gt;&amp;nbsp;&lt;/P&gt;
&lt;P&gt;I want the Report to register the date&lt;STRONG&gt; ONLY when&amp;nbsp;new values date and to NOT replace current dates&lt;/STRONG&gt;, so I can keep track of when the NAMES were added by the Report.&lt;BR /&gt;&lt;BR /&gt;I tried the following line but it doesn't do what I want. It always replace with the time the Report ran:&lt;BR /&gt;&lt;BR /&gt;| eval Report_Update = strftime(now(),"%d/%m/%Y %H:%M:%S")&lt;BR /&gt;&lt;BR /&gt;And "_time" gives me the date of when it was added to the index.&lt;BR /&gt;&lt;BR /&gt;Is there a specific way to register this info?&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;</description>
      <pubDate>Wed, 08 Mar 2023 20:35:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633608#M108476</guid>
      <dc:creator>PTC_</dc:creator>
      <dc:date>2023-03-08T20:35:29Z</dc:date>
    </item>
    <item>
      <title>Re: Log Date when Report/Query adds new values</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633615#M108477</link>
      <description>&lt;P&gt;To set a field only when it's null, use the &lt;FONT face="courier new,courier"&gt;coalesce&lt;/FONT&gt; command.&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Report_Update = coalesce(Report_Update, strftime(now(),"%d/%m/%Y %H:%M:%S"))&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Tue, 07 Mar 2023 17:36:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633615#M108477</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2023-03-07T17:36:49Z</dc:date>
    </item>
    <item>
      <title>Re: Log Date when Report/Query adds new values</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633702#M108488</link>
      <description>&lt;P&gt;Is not updating the null fields with this command.&lt;BR /&gt;Any idea of what I could be doing wrong?&lt;/P&gt;</description>
      <pubDate>Wed, 08 Mar 2023 10:34:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633702#M108488</guid>
      <dc:creator>PTC_</dc:creator>
      <dc:date>2023-03-08T10:34:24Z</dc:date>
    </item>
    <item>
      <title>Re: Log Date when Report/Query adds new values</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633727#M108500</link>
      <description>&lt;P&gt;It's possible the fields are not really null so &lt;FONT face="courier new,courier"&gt;coalesce&lt;/FONT&gt; doesn't touch them.&lt;/P&gt;&lt;P&gt;Can you share the full query and some sample data for it?&lt;/P&gt;</description>
      <pubDate>Wed, 08 Mar 2023 13:53:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633727#M108500</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2023-03-08T13:53:53Z</dc:date>
    </item>
    <item>
      <title>Re: Log Date when Report/Query adds new values</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633773#M108507</link>
      <description>&lt;P&gt;I did the inverse and it worked for my case:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| eval Report_Update = coalesce(strftime(now(),"%d/%m/%Y %H:%M:%S"),Report_Update)&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thank you!&lt;/P&gt;</description>
      <pubDate>Wed, 08 Mar 2023 17:07:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-log-date-when-report-query-adds-new-values/m-p/633773#M108507</guid>
      <dc:creator>PTC_</dc:creator>
      <dc:date>2023-03-08T17:07:12Z</dc:date>
    </item>
  </channel>
</rss>

