Hi,
We have a huge lookup file with accounts’ data. Some of lookup’s columns has a value for each account, lake ‘username’ or ‘startdate’. However, another one may have no value at all, like ‘subcontractor’.
When we perform a search like subcontractor=company_A it works great, but when we perform a search like subcontractor=* it returns no result.
The only solution we were able to find is to use an eval function to create an empty value for every column:
| eval subcontractor =if(isnotnull(subcontractor), subcontractor,"")
It works but it doesn’t looks like the right way to do it, especially if you have dozens columns like this one. Do you now a better way to deal with lookup’s columns?
Thanks for the help.
