Getting Data In

fill an occasional Null field with the current time

jacqu3sy
Path Finder

I have a search outputting results which includes a field for 'closedtime'. On occasion however this field will be blank. When this occurs, how do I fill this field with the current time?

Appreciate any help!

Tags (1)
0 Karma
1 Solution

dineshraj9
Builder

Try this -

| eval closedtime=if(isnull(closedtime) OR len(closedtime)==0,strftime(now(),"%F %T %Z"),closedtime)

View solution in original post

dineshraj9
Builder

Try this -

| eval closedtime=if(isnull(closedtime) OR len(closedtime)==0,strftime(now(),"%F %T %Z"),closedtime)

jacqu3sy
Path Finder

Seems to work, would you mind explaining the logic behind it? Not sure I fully understand how its working!?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The if condition check if the value of the field closedtime is either null OR blank (length is 0), if it is, use the current time given in epoch format by function now() and format it to string timestamp using strftime function. If it's neither null nor blank, use the value of field itself.

jacqu3sy
Path Finder

Great explanation, makes perfect sense. Thanks both.

0 Karma

dineshraj9
Builder

Thanks @somesoni!

@jacqu3sy - You can modify the parameters to the strftime function to have the time format as you same as the closedtime values - http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Commontimeformatvariables

0 Karma

jacqu3sy
Path Finder

Thats great, thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...