Splunk Search

Add missing value to field in event or record via query

atornes
Path Finder

I have some events/records in my data that occurred in the past and we have since added some fields that for these events/records, is now null/blank. I'd like to be able to query for these events and add a value to the field just as you can with the | delete operator. Any idea how to do this?

Tags (4)
0 Karma

lguinn2
Legend

You cannot add data to any existing event in the index. However, perhaps you could use a lookup table to establish values for these fields when they are null. Hint: don't overwrite existing values with an automatic lookup.

I could say more about lookups, if you could explain a bit about the queries you were considering.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...