https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-field-with-the-time-now/m-p/274937#M82925 <P>My search throws empty time-related fields and I want to fill that compo with the current time</P> Thu, 02 Feb 2017 23:07:23 GMT medveleyenet1 2017-02-02T23:07:23Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-field-with-the-time-now/m-p/274937#M82925 <P>My search throws empty time-related fields and I want to fill that compo with the current time</P> Thu, 02 Feb 2017 23:07:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-field-with-the-time-now/m-p/274937#M82925 medveleyenet1 2017-02-02T23:07:23Z https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-field-with-the-time-now/m-p/274938#M82926 <P>Try adding this in to your search:</P> <PRE><CODE>| eval now_time=now() | eval filled_time=coalesce(YourTimeFieldHere,now_time)| </CODE></PRE> <P>Replace YourTimeFieldHere with whatever the name of your time-related field is. That should place the value of now() which is the current time into any empty value of your time field.</P> Thu, 02 Feb 2017 23:41:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fill-empty-field-with-the-time-now/m-p/274938#M82926 briancronrath 2017-02-02T23:41:41Z