Getting Data In

How do I replace null values at index time rather than search time?

jackreeves
Explorer

How do I replace null values at index time rather than search time?

Tried adding this to props.conf file but it didn't make a difference.
SEDCMD-replaceblanks = s/,,/,Null,/g

I know I can do a fillnull values function within a search but would rather do this at the point of indexing
Could someone give me some advice?

Many thanks

0 Karma

adonio
Ultra Champion
0 Karma

jackreeves
Explorer

I did try this answer before posting but doesn't appear to have worked.

0 Karma

harsmarvania57
Ultra Champion

Can you please provide your props.conf configuration with some sample data ?

0 Karma

jackreeves
Explorer

Here is the props.conf example:

[example]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = "Date Closed"
TIME_FORMAT = %d/%m/%Y
category = Structured
pulldown_type = 1
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
SEDCMD-replaceblanks = s/,,/,Null,/g

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...