Getting Data In

How do I replace null values at index time rather than search time?

jackreeves
Explorer

How do I replace null values at index time rather than search time?

Tried adding this to props.conf file but it didn't make a difference.
SEDCMD-replaceblanks = s/,,/,Null,/g

I know I can do a fillnull values function within a search but would rather do this at the point of indexing
Could someone give me some advice?

Many thanks

0 Karma

adonio
Ultra Champion
0 Karma

jackreeves
Explorer

I did try this answer before posting but doesn't appear to have worked.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Can you please provide your props.conf configuration with some sample data ?

0 Karma

jackreeves
Explorer

Here is the props.conf example:

[example]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = "Date Closed"
TIME_FORMAT = %d/%m/%Y
category = Structured
pulldown_type = 1
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
SEDCMD-replaceblanks = s/,,/,Null,/g

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...