https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486932#M193759 <P>this works if record does not exist, at times it ( column1=3) can exist as well.. </P> Fri, 24 Apr 2020 19:22:03 GMT jiaqya 2020-04-24T19:22:03Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486930#M193757 <P>exmaple below</P> <P>column1:column2<BR /> 1:10<BR /> 2:15<BR /> 4:30<BR /> 5:40</P> <P>in this example, column1 is missing "3", i would like to create this record with a "0" value in column2.<BR /> how can this be done ?</P> <P>thanks..</P> Fri, 24 Apr 2020 14:34:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486930#M193757 jiaqya 2020-04-24T14:34:05Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486931#M193758 <P>Use append:</P> <PRE><CODE>&lt;your search&gt; | append [| makeresults | eval column1=3, column2=0] </CODE></PRE> Fri, 24 Apr 2020 16:13:51 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486931#M193758 manjunathmeti 2020-04-24T16:13:51Z https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486932#M193759 <P>this works if record does not exist, at times it ( column1=3) can exist as well.. </P> Fri, 24 Apr 2020 19:22:03 GMT https://community.splunk.com/t5/Splunk-Search/how-to-create-a-record-if-missing/m-p/486932#M193759 jiaqya 2020-04-24T19:22:03Z