Reporting

add value to kvstore only if its not empty

angelinealex
Communicator

Hi,
I have couple of questions.

    .........
    eval fieldname=....
   | outputlookup my_kvstore_lookup
  1. How to add fieldname value to kvstore only if fieldname is not null/no empty. When its empty it shouldn't add to the kvstore.

  2. Another question is, can I add a value to kvstore in the middle of the saved searches? Because at the end of saved search I have to summary index the data.

Looking for some urgent help.
Thank you.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...