add value to kvstore only if its not empty


I have couple of questions.

    eval fieldname=....
   | outputlookup my_kvstore_lookup
  1. How to add fieldname value to kvstore only if fieldname is not null/no empty. When its empty it shouldn't add to the kvstore.

  2. Another question is, can I add a value to kvstore in the middle of the saved searches? Because at the end of saved search I have to summary index the data.

Looking for some urgent help.
Thank you.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!