Is there a way to use search commands like FillNull and/or Eval to clean up the data in a Data Object? I have these commands working when i run searches but can not figure out how to applie them to my data object 1) I'm trying to add a column for openrates to a pivot - sourcetype="NMG _ Logfile" | stats count AS totalsent, count(eval(viewed>0)) AS "totalopens" | eval openrate = round(totalopens/totalsent, 2) I'm trying to fillin empty values in my data object | fillnull value=NULL Thanks, John ... View more

Hi, When i input data from files & directories in splunk, is there a way to ignore the first row (column headers) in a CSV data source? Thanks, John ... View more

Hi, I'm trying to use regex to define where my stamp stamp is in the data below. I have it working for some of the data but there are instances where it does not work, and I'm struggling to understand why... the data looks the same. Any ideas? Regex: ,(?=\d{1}/\d{2}/\d{4} \d{2}:\d{2}) Format: %m/%d/%Y %H:%M Works here: 38112544113,mmehltretter@legendequities.com,gabriela.fuselli@lfd.com,38112,AML Wholesaler NMG Template,9/29/2013 19:30,... Timestamp = 9/29/13 7:30:00.000 PM Does not work here: 36277629151,arnold.cottrell@lfg.com,nicole.hartnett@lfg.com,36277,Welcome: Extended Leadership Team,8/16/2013 8:56,...,,,9/30/2013 23:00, TimeStamp = 9/30/13 11:00:00.000 PM (picking up another time later in event string) OR Here: 37866185650,dconoway@americanportfolios.com,gabriela.fuselli@lfd.com,37866,AML Wholesaler NMG Template,9/24/2013 7:39,....,,,9/30/2013 22:59, Timestamp = 9/30/13 10:59:00.000 PM (picking up another time later in event string) ... View more