Getting Data In
Highlighted

How do I replace null values at index time rather than search time?

Explorer

How do I replace null values at index time rather than search time?

Tried adding this to props.conf file but it didn't make a difference.
SEDCMD-replaceblanks = s/,,/,Null,/g

I know I can do a fillnull values function within a search but would rather do this at the point of indexing
Could someone give me some advice?

Many thanks

0 Karma
Highlighted

Re: How do I replace null values at index time rather than search time?

SplunkTrust
SplunkTrust

Can you please provide your props.conf configuration with some sample data ?

0 Karma
Highlighted

Re: How do I replace null values at index time rather than search time?

Explorer

Here is the props.conf example:

[example]
DATETIMECONFIG =
INDEXED
EXTRACTIONS = csv
KVMODE = none
NO
BINARYCHECK = true
SHOULD
LINEMERGE = false
TIMESTAMPFIELDS = "Date Closed"
TIME
FORMAT = %d/%m/%Y
category = Structured
pulldowntype = 1
disabled = false
HEADER
FIELDLINENUMBER = 1
SEDCMD-replaceblanks = s/,,/,Null,/g

0 Karma
Highlighted

Re: How do I replace null values at index time rather than search time?

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: How do I replace null values at index time rather than search time?

Explorer

I did try this answer before posting but doesn't appear to have worked.

0 Karma