topic Re: Using Search Commands in Data Objects in Splunk Search

Using Search Commands in Data Objects

jgautreau — Tue, 26 Nov 2013 22:13:31 GMT

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

Re: Using Search Commands in Data Objects

somesoni2 — Fri, 29 Nov 2013 21:42:25 GMT

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

Re: Using Search Commands in Data Objects

jgautreau — Tue, 10 Dec 2013 21:47:56 GMT

thanks - that is a big help 🙂

Re: Using Search Commands in Data Objects

jgautreau — Tue, 10 Dec 2013 21:48:16 GMT

thank you - big help

Re: Using Search Commands in Data Objects

jgautreau — Tue, 10 Dec 2013 21:49:31 GMT

when i use |datamodel, do i simply use it to create a root search object?