<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How do I replace null value in Pivot? in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389587#M6639</link>
    <description>&lt;P&gt;I have a pivot table that has a null value for a few of the records in the "Date" column that is preventing me from sorting the table. How and with what do I replace the null value in the Date column?&lt;/P&gt;</description>
    <pubDate>Fri, 28 Dec 2018 09:40:29 GMT</pubDate>
    <dc:creator>juzzbitzz</dc:creator>
    <dc:date>2018-12-28T09:40:29Z</dc:date>
    <item>
      <title>How do I replace null value in Pivot?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389587#M6639</link>
      <description>&lt;P&gt;I have a pivot table that has a null value for a few of the records in the "Date" column that is preventing me from sorting the table. How and with what do I replace the null value in the Date column?&lt;/P&gt;</description>
      <pubDate>Fri, 28 Dec 2018 09:40:29 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389587#M6639</guid>
      <dc:creator>juzzbitzz</dc:creator>
      <dc:date>2018-12-28T09:40:29Z</dc:date>
    </item>
    <item>
      <title>Re: How do I replace null value in Pivot?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389588#M6640</link>
      <description>&lt;P&gt;@juzzbitzz,&lt;/P&gt;

&lt;P&gt;Try adding &lt;CODE&gt;|fillnull value="your value for date" Date&lt;/CODE&gt; in the base search before aggregation/sort&lt;/P&gt;</description>
      <pubDate>Sat, 29 Dec 2018 11:56:47 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389588#M6640</guid>
      <dc:creator>renjith_nair</dc:creator>
      <dc:date>2018-12-29T11:56:47Z</dc:date>
    </item>
    <item>
      <title>Re: How do I replace null value in Pivot?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389589#M6641</link>
      <description>&lt;P&gt;You need to populate the Date field.&lt;/P&gt;

&lt;P&gt;Identify, on the records with no Date, what is a good candidate for substitution, then do something like &lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| eval Date = coalesce(Date,mySubstituteField)  
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Mon, 31 Dec 2018 18:46:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389589#M6641</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2018-12-31T18:46:21Z</dc:date>
    </item>
    <item>
      <title>Re: How do I replace null value in Pivot?</title>
      <link>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389590#M6642</link>
      <description>&lt;P&gt;You have 3 options:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...  | eval Date = coalesce(Date, yourAlternateFieldHere, "Your Hard-Coded Default Value Here")
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...  | fillnull value="Your Hard-Coded Default Value Here" Date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;OR&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;...  | filldown Date
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;I leave it as an exercise for the reader to figure our (or @DalJeanis to explain) the differences.&lt;/P&gt;</description>
      <pubDate>Tue, 01 Jan 2019 04:28:25 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/How-do-I-replace-null-value-in-Pivot/m-p/389590#M6642</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-01-01T04:28:25Z</dc:date>
    </item>
  </channel>
</rss>

