In the data source I am ingesting it can happen that one of the fields is not present from time to time. The issue is when I am running a search on it and if I add that dimension to the query that event is not part of the calculation.
Is it possible to somehow add a field to metrics with a default value if it is not present in the raw event?
Have you tried something like:
index=YOURINDEX FIELD_Name>* OR NOT FIELD_name
| eval FIELD_Name=if(isnotnull(FIELD_Name), FIELD_Name, "Default value to fill in")
https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/NOTexpressions
Agreed, that would work in regular indexes, but I need it for metrics based indexes.