Empty strings are counted | makeresults
| eval a="a", b="b", d=""
| eval a=mvappend(a, "", b, d)
| eval c=mvcount(a) and the foreach would result in an empty row | foreach *
[ | eval a=mva...
See more...
Empty strings are counted | makeresults
| eval a="a", b="b", d=""
| eval a=mvappend(a, "", b, d)
| eval c=mvcount(a) and the foreach would result in an empty row | foreach *
[ | eval a=mvappend(a, if("<<FIELD>>"="location", "", json_object("location",'location',"name","<<FIELD>>","value",'<<FIELD>>'))) ] and I'd always made the assumption that using null was because mvappend was a bit strange, but you're right it is just another field - have to go check some old searches