Knowledge Management

How do I populate a summary index with the collect command if a field value is an empty string and will become a null value?

chanmi2
Path Finder

In order to create a timestamp with a specific field, my search is like

search xxx| eval _raw=FIELD_TIME.", FIELD_A=\"".FIELD_A."\", FIELD_B=\"".FIELD_B."\"" | collect index=yyy

But if FIELD_A is an empty string and it will become a null value in index=yyy. Anyone know how to fix it? Thanks

0 Karma

somesoni2
Revered Legend

Try something like this

search xxx| eval _raw=FIELD_TIME.", FIELD_A=\"".coalesce(FIELD_A,"")."\", FIELD_B=\"".FIELD_B."\"" | collect index=yyy
0 Karma

chanmi2
Path Finder

It does not work

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the fillnull command to replace null values with something else. This command replaces all null values with a single space, but you can limit it to FIELD_A if you wish.

search xxx| fillnull value=' ' | eval _raw=FIELD_TIME.", FIELD_A=\"".FIELD_A."\", FIELD_B=\"".FIELD_B."\"" | collect index=yyy
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...