Hello to all,
I have a multivalue field with a content.errormsg with values and also with a null value. If the null value in the fields it will not showing any results in the output
example:
errormsg
closed connection
Empty String
null
needed result:
errormsg
closed connection
Empty String
Sure thing, you can use the mvfilter eval function to get rid of the unwanted value in the multivalue field
| eval yourfield = mvfilter(yourfield != "null")
Do you mean something like this?
| eval errormsg=mvfilter(errormsg!="null")