https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752740#M242670 <P class="lia-align-justify">Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/189417">@spisiakmi</a>&nbsp;</P><P class="lia-align-justify">I dont think your&nbsp;<EM>isnotnull</EM> is matchnig as you expect on "", try this:</P><LI-CODE lang="markup">| makeresults | eval tmp_1=1 | eval tmp_2="" | eval tmp_3=3 | eval tmp="" | foreach tmp_* [| eval tmp = tmp.if(&lt;&lt;FIELD&gt;&gt;!="",&lt;&lt;FIELD&gt;&gt;."|","")] | eval tmp=trim(tmp,"|") | table tmp</LI-CODE><P>&nbsp;</P> Fri, 05 Sep 2025 10:44:26 GMT livehybrid 2025-09-05T10:44:26Z https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752735#M242668 <P>Hi, any help, please?</P><P>Here is the code</P><P><EM>| makeresults </EM><BR /><EM>| eval tmp_1=1</EM><BR /><EM>| eval tmp_2=""</EM><BR /><EM>| eval tmp_3=3</EM><BR /><EM>| eval tmp=""</EM><BR /><EM>| foreach tmp_*</EM><BR /><EM>[| eval tmp = tmp ."|".if(isnotnull(&lt;&lt;FIELD&gt;&gt;),&lt;&lt;FIELD&gt;&gt;,"")]</EM><BR /><EM>| eval tmp=substr(tmp, 2)</EM><BR /><EM>| table tmp</EM></P><P>Output is: <EM>tmp=1||3</EM></P><P>I would like to have output <EM>tmp="1|3",&nbsp;</EM>it means how to skip the step in foreach, if the&nbsp;<EM>&lt;&lt;FIELD&gt;&gt; </EM>is null?</P> Fri, 05 Sep 2025 09:40:51 GMT https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752735#M242668 spisiakmi 2025-09-05T09:40:51Z https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752736#M242669 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/189417">@spisiakmi</a>&nbsp;,</P><P>please try this:</P><LI-CODE lang="markup">| makeresults | eval tmp_1=1 | eval tmp_2="" | eval tmp_3=3 | eval tmp="" | foreach tmp_* [| eval tmp = tmp ."|".if(isnotnull(&lt;&lt;FIELD&gt;&gt;),&lt;&lt;FIELD&gt;&gt;,"")] | eval tmp=substr(tmp, 2) | rex field=tmp mode=sed "s/\|+/|/g" | table tmp</LI-CODE><P>Ciao.</P><P>Giuseppe</P><P>&nbsp;</P> Fri, 05 Sep 2025 10:00:45 GMT https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752736#M242669 gcusello 2025-09-05T10:00:45Z https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752740#M242670 <P class="lia-align-justify">Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/189417">@spisiakmi</a>&nbsp;</P><P class="lia-align-justify">I dont think your&nbsp;<EM>isnotnull</EM> is matchnig as you expect on "", try this:</P><LI-CODE lang="markup">| makeresults | eval tmp_1=1 | eval tmp_2="" | eval tmp_3=3 | eval tmp="" | foreach tmp_* [| eval tmp = tmp.if(&lt;&lt;FIELD&gt;&gt;!="",&lt;&lt;FIELD&gt;&gt;."|","")] | eval tmp=trim(tmp,"|") | table tmp</LI-CODE><P>&nbsp;</P> Fri, 05 Sep 2025 10:44:26 GMT https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752740#M242670 livehybrid 2025-09-05T10:44:26Z https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752741#M242671 <P><SPAN>livehybrid thank you very much, simple, easy, fast. Very good.</SPAN></P> Fri, 05 Sep 2025 11:05:53 GMT https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752741#M242671 spisiakmi 2025-09-05T11:05:53Z https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752742#M242672 <P>Hey&nbsp;<SPAN>gcusello, thank you very much.</SPAN></P> Fri, 05 Sep 2025 11:06:58 GMT https://community.splunk.com/t5/Splunk-Search/skip-step-in-foreach/m-p/752742#M242672 spisiakmi 2025-09-05T11:06:58Z