Splunk Search

Using Search Commands in Data Objects

jgautreau
Explorer

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

jgautreau
Explorer

thanks - that is a big help 🙂

0 Karma

somesoni2
Revered Legend

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

jgautreau
Explorer

when i use |datamodel, do i simply use it to create a root search object?

0 Karma

jgautreau
Explorer

thank you - big help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

Data Management Digest – May 2026

Welcome to the May 2026 edition of Data Management Digest!   As your trusted partner in data innovation, the ...