metrics - if field not present in raw data how to add it with default value?

[imrago]

In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation. 

Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?

[solarboyz1]

Have you tried something like:

 index=YOURINDEX   FIELD_Name>*  OR NOT FIELD_name
| eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in")

https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions

[imrago]

Agreed, that would work in regular indexes, but I need it for metrics based indexes.