https://community.splunk.com/t5/Splunk-Search/Add-missing-value-to-field-in-event-or-record-via-query/m-p/64684#M15981 <P>I have some events/records in my data that occurred in the past and we have since added some fields that for these events/records, is now null/blank. I'd like to be able to query for these events and add a value to the field just as you can with the | delete operator. Any idea how to do this?</P> Fri, 03 Feb 2012 20:45:23 GMT atornes 2012-02-03T20:45:23Z https://community.splunk.com/t5/Splunk-Search/Add-missing-value-to-field-in-event-or-record-via-query/m-p/64684#M15981 <P>I have some events/records in my data that occurred in the past and we have since added some fields that for these events/records, is now null/blank. I'd like to be able to query for these events and add a value to the field just as you can with the | delete operator. Any idea how to do this?</P> Fri, 03 Feb 2012 20:45:23 GMT https://community.splunk.com/t5/Splunk-Search/Add-missing-value-to-field-in-event-or-record-via-query/m-p/64684#M15981 atornes 2012-02-03T20:45:23Z https://community.splunk.com/t5/Splunk-Search/Add-missing-value-to-field-in-event-or-record-via-query/m-p/64685#M15982 <P>You cannot add data to any existing event in the index. However, perhaps you could use a lookup table to establish values for these fields when they are null. Hint: don't overwrite existing values with an automatic lookup.</P> <P>I could say more about lookups, if you could explain a bit about the queries you were considering.</P> Fri, 03 Feb 2012 22:17:47 GMT https://community.splunk.com/t5/Splunk-Search/Add-missing-value-to-field-in-event-or-record-via-query/m-p/64685#M15982 lguinn2 2012-02-03T22:17:47Z