Reporting

add value to kvstore only if its not empty

angelinealex
Communicator

Hi,
I have couple of questions.

    .........
    eval fieldname=....
   | outputlookup my_kvstore_lookup
  1. How to add fieldname value to kvstore only if fieldname is not null/no empty. When its empty it shouldn't add to the kvstore.

  2. Another question is, can I add a value to kvstore in the middle of the saved searches? Because at the end of saved search I have to summary index the data.

Looking for some urgent help.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...