https://community.splunk.com/t5/Splunk-Search/mvexpand-acts-like-a-filter/m-p/62523#M15430 <P>This is old, so I'm sure you've figured it out, but a question deserves an answer... </P> <P>You need to use</P> <PRE><CODE>fillnull value="-" CVEID </CODE></PRE> <P>before the mvexpand to not lose records that have no CVEID value.</P> Mon, 12 Aug 2013 23:39:18 GMT vbumgarner 2013-08-12T23:39:18Z https://community.splunk.com/t5/Splunk-Search/mvexpand-acts-like-a-filter/m-p/62522#M15429 <P>I'm building an app to manage Nessus vulnerability data and grab CVE data from the National Vulnerability Database (NVDB). The search does the following: </P> <P>Searches for all Nessus plugin scripts<BR /><BR /> Dedupes events by Nessus ID<BR /><BR /> Replaces a number of field values to make them human readable<BR /><BR /> Performs a lookup by Nessus ID and returns any CVE IDs associated with the plugin </P> <P>Some plugins have one or more CVE IDs. Some don't have any. When I pipe that search to the mvexpand command, events without CVE IDs disappear from the search results. </P> <P>Is there an easy way to make the mvexpand command conditional only on events that have a CVE ID?</P> <P>Thanks.</P> <P>Craig</P> Tue, 29 May 2012 18:10:48 GMT https://community.splunk.com/t5/Splunk-Search/mvexpand-acts-like-a-filter/m-p/62522#M15429 responsys_cm 2012-05-29T18:10:48Z https://community.splunk.com/t5/Splunk-Search/mvexpand-acts-like-a-filter/m-p/62523#M15430 <P>This is old, so I'm sure you've figured it out, but a question deserves an answer... </P> <P>You need to use</P> <PRE><CODE>fillnull value="-" CVEID </CODE></PRE> <P>before the mvexpand to not lose records that have no CVEID value.</P> Mon, 12 Aug 2013 23:39:18 GMT https://community.splunk.com/t5/Splunk-Search/mvexpand-acts-like-a-filter/m-p/62523#M15430 vbumgarner 2013-08-12T23:39:18Z