|
I have some events/records in my data that occurred in the past and we have since added some fields that for these events/records, is now null/blank. I'd like to be able to query for these events and add a value to the field just as you can with the | delete operator. Any idea how to do this? |
One Answer:
|
You cannot add data to any existing event in the index. However, perhaps you could use a lookup table to establish values for these fields when they are null. Hint: don't overwrite existing values with an automatic lookup. I could say more about lookups, if you could explain a bit about the queries you were considering. |
