Splunk Search

Add missing value to field in event or record via query

Path Finder

I have some events/records in my data that occurred in the past and we have since added some fields that for these events/records, is now null/blank. I'd like to be able to query for these events and add a value to the field just as you can with the | delete operator. Any idea how to do this?

Tags (4)
0 Karma


You cannot add data to any existing event in the index. However, perhaps you could use a lookup table to establish values for these fields when they are null. Hint: don't overwrite existing values with an automatic lookup.

I could say more about lookups, if you could explain a bit about the queries you were considering.

0 Karma