Hi, im looking for something simular and just found this. Perhaps this could help you out. https://docs.splunk.com/Documentation/Splunk/9.0.3/DashStudio/tokens
... View more
Hi, What you can try is | fillnull value= don't fill anything after the = I'm having the same issue and this works for me, let me know if it works for you.
... View more