Splunk Search

Using Search Commands in Data Objects

jgautreau
Explorer

Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object?

I have these commands working when i run searches but can not figure out how to applie them to my data object

1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent,

2) I'm trying to fillin empty values in my data object | fillnull value=NULL

Thanks, John

jgautreau
Explorer

thanks - that is a big help 🙂

0 Karma

somesoni2
Revered Legend

|datamodel command: - after below syntax, you can use any regular search command like stats or fillnull.

    Syntax 
         |datamodel <DataModelName> <DataObjectName> search
Eg. 
    |datamodel Tutorial Successful_Purchase search | eval test="ABC"
   |datamodel Tutorial Successful_Purchase search | fillnull value=NULL categoryId

jgautreau
Explorer

when i use |datamodel, do i simply use it to create a root search object?

0 Karma

jgautreau
Explorer

thank you - big help

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...