https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339784#M92972 <P>Thats great, thanks.</P> Fri, 21 Apr 2017 16:01:14 GMT jacqu3sy 2017-04-21T16:01:14Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339778#M92966 <P>I have a search outputting results which includes a field for 'closedtime'. On occasion however this field will be blank. When this occurs, how do I fill this field with the current time?</P> <P>Appreciate any help!</P> Thu, 20 Apr 2017 12:06:16 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339778#M92966 jacqu3sy 2017-04-20T12:06:16Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339779#M92967 <P>Try this -</P> <PRE><CODE>| eval closedtime=if(isnull(closedtime) OR len(closedtime)==0,strftime(now(),"%F %T %Z"),closedtime) </CODE></PRE> Thu, 20 Apr 2017 12:59:24 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339779#M92967 dineshraj9 2017-04-20T12:59:24Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339780#M92968 <P>Seems to work, would you mind explaining the logic behind it? Not sure I fully understand how its working!?</P> Thu, 20 Apr 2017 15:06:07 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339780#M92968 jacqu3sy 2017-04-20T15:06:07Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339781#M92969 <P>The if condition check if the value of the field <CODE>closedtime</CODE> is either null OR blank (length is 0), if it is, use the current time given in epoch format by function <CODE>now()</CODE> and format it to string timestamp using strftime function. If it's neither null nor blank, use the value of field itself.</P> Thu, 20 Apr 2017 15:40:54 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339781#M92969 somesoni2 2017-04-20T15:40:54Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339782#M92970 <P>Thanks @somesoni!</P> <P>@jacqu3sy - You can modify the parameters to the strftime function to have the time format as you same as the closedtime values - <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables">http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables</A></P> Fri, 21 Apr 2017 05:08:18 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339782#M92970 dineshraj9 2017-04-21T05:08:18Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339783#M92971 <P>Great explanation, makes perfect sense. Thanks both.</P> Fri, 21 Apr 2017 16:00:57 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339783#M92971 jacqu3sy 2017-04-21T16:00:57Z https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339784#M92972 <P>Thats great, thanks.</P> Fri, 21 Apr 2017 16:01:14 GMT https://community.splunk.com/t5/Getting-Data-In/fill-an-occasional-Null-field-with-the-current-time/m-p/339784#M92972 jacqu3sy 2017-04-21T16:01:14Z