This is confusing because when you Export the report results from the UI, the date format is preserved, but when you let Splunk email it on a schedule, the date format is lost. It should at least be made consistent... As it stands, it's impossible to test report output without scheduling a report and reviewing the email. ... View more

COALESCE is the ANSI standard SQL function equivalent to Oracle NVL. Unlike NVL, COALESCE supports more than two fields in the list. In Splunk, coalesce() returns the value of the first non-null field in the list. Here's an example where you'd get the Preferred_Name if it's present, otherwise use the First_name if it's present, and if both of those are null, then just use the word "Friend". If you didn't include a default at the end, and both fields were blank, you'd just get a blank. eval name_to_use=coalesce(preferred_name,first_name,"Friend")| table name_to_use ... View more

Hmm, strftime doesn't sort dates properly, though. Can fieldformat be used somehow to achieve the same visible text but maintain date sorting? ... View more