Splunk Search

Using Search Commands in Data Objects

jgautreau
Explorer

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

jgautreau
Explorer

thanks - that is a big help 🙂

0 Karma

somesoni2
Revered Legend

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

jgautreau
Explorer

when i use |datamodel, do i simply use it to create a root search object?

0 Karma

jgautreau
Explorer

thank you - big help

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...