Getting Data In

How do I replace null values at index time rather than search time?

jackreeves
Explorer

How do I replace null values at index time rather than search time?

Tried adding this to props.conf file but it didn't make a difference.
SEDCMD-replaceblanks = s/,,/,Null,/g

I know I can do a fillnull values function within a search but would rather do this at the point of indexing
Could someone give me some advice?

Many thanks

0 Karma

adonio
Ultra Champion
0 Karma

jackreeves
Explorer

I did try this answer before posting but doesn't appear to have worked.

0 Karma

harsmarvania57
Ultra Champion

Can you please provide your props.conf configuration with some sample data ?

0 Karma

jackreeves
Explorer

Here is the props.conf example:

[example]
DATETIME_CONFIG =
INDEXED_EXTRACTIONS = csv
KV_MODE = none
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TIMESTAMP_FIELDS = "Date Closed"
TIME_FORMAT = %d/%m/%Y
category = Structured
pulldown_type = 1
disabled = false
HEADER_FIELD_LINE_NUMBER = 1
SEDCMD-replaceblanks = s/,,/,Null,/g

0 Karma
Get Updates on the Splunk Community!

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...

4 Ways the Splunk Community Helps You Prepare for .conf25

.conf25 is right around the corner, and whether you’re a first-time attendee or a seasoned Splunker, the ...