Splunk Search

Using Search Commands in Data Objects

jgautreau
Explorer

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

jgautreau
Explorer

thanks - that is a big help 🙂

0 Karma

somesoni2
Revered Legend

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

jgautreau
Explorer

when i use |datamodel, do i simply use it to create a root search object?

0 Karma

jgautreau
Explorer

thank you - big help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Detection Engineering Office Hours: Real-World Troubleshooting & Q&A

[REGISTER HERE] This thread is for the Community Office Hours session on Detection Engineering Office Hours: ...

Developer Spotlight with Mika Borner

From Hackathon Winner to Enterprise Leader    Mika Borner, CEO and Founder of Datapunctum AG, has been ...

Continue Your Federation Journey: Join Session 3 of the Bootcamp Series

To help practitioners build a stronger foundation, we launched the Data Management & Federation ...