How to exclude null values in mv fields?

[karthi2809]

In my mv field nameas  errortype.In the error type the counts shows file not found as 4 and empty as 2 .I want to exclude the empty values from the mv fields

[ITWhisperer]

Are these multivalue fields within the same event?

By "empty" do you mean they contain the word "empty" or that they have no value (empty string) or that they don't exist?

Please share some sample (anonymised) events to illustrate what you mean.

[karthi2809]

Its empty in the field .Attached screenshot. For some of the transaction we have multiple error type with empty values and with values.

For the same transaction below events are there with empty and with value.

"timestamp" : "2024-03-21T17:33:53.993Z", "content" : { "ErrorType" : "", "ErrorMsg" : "" }

"timestamp" : "2024-03-21T17:33:20.786Z", "content" : { "ErrorType" : "HTTP:NOT_FOUND", "ErrorMsg" : "HTTP /glimport' failed: not found (404)." },

[ITWhisperer · Accepted solution]

| where ErrorType != ""