@PickleRick - off topic from OP's original posting, but in response to the error: That templatized field error I believe is due to how mvappend works - it does not like null() but null is ok, i.e. t...
See more...
@PickleRick - off topic from OP's original posting, but in response to the error: That templatized field error I believe is due to how mvappend works - it does not like null() but null is ok, i.e. this is fine | foreach *
[ | eval a=mvappend(a, if("<<FIELD>>"="location", null, json_object("location",'location',"name","<<FIELD>>","value",'<<FIELD>>'))) ] and null() is fine if you take mvappend out of the equation, i.e. [ | eval a=if("<<FIELD>>"="location", null(), json_object("location",'location',"name","<<FIELD>>","value",'<<FIELD>>')) ] See that this fails | makeresults
| eval a="a"
| eval a=mvappend(a, null())
| eval c=mvcount(a) but null on its own works.