topic Re: How do I replace null values at index time rather than search time? in Getting Data In

How do I replace null values at index time rather than search time?

jackreeves — Wed, 31 Jan 2018 15:51:53 GMT

How do I replace null values at index time rather than search time?

Tried adding this to props.conf file but it didn't make a difference.
SEDCMD-replaceblanks = s/,,/,Null,/g

I know I can do a fillnull values function within a search but would rather do this at the point of indexing
Could someone give me some advice?

Many thanks

Re: How do I replace null values at index time rather than search time?

harsmarvania57 — Wed, 31 Jan 2018 16:16:22 GMT

Can you please provide your props.conf configuration with some sample data ?

Re: How do I replace null values at index time rather than search time?

adonio — Wed, 31 Jan 2018 16:20:23 GMT

hello there,

checkout this answer by @somesoni2

https://answers.splunk.com/answers/434015/is-it-possible-to-replace-null-fields-at-index-tim.html

hope it helps

Re: How do I replace null values at index time rather than search time?

jackreeves — Tue, 29 Sep 2020 17:56:49 GMT

Here is the props.conf example:

[example]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = "Date Closed"
TIME_FORMAT = %d/%m/%Y
category = Structured
pulldown_type = 1
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
SEDCMD-replaceblanks = s/,,/,Null,/g

Re: How do I replace null values at index time rather than search time?

jackreeves — Fri, 02 Feb 2018 11:28:32 GMT

I did try this answer before posting but doesn't appear to have worked.