Reporting

add value to kvstore only if its not empty

angelinealex
Communicator

Hi,
I have couple of questions.

    .........
    eval fieldname=....
   | outputlookup my_kvstore_lookup
  1. How to add fieldname value to kvstore only if fieldname is not null/no empty. When its empty it shouldn't add to the kvstore.

  2. Another question is, can I add a value to kvstore in the middle of the saved searches? Because at the end of saved search I have to summary index the data.

Looking for some urgent help.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...