https://community.splunk.com/t5/Splunk-Search/Coalesce-and-multivalued-fields/m-p/92642#M23922 <P>I still don't know why coalesce removes the commas that delimit a multivalued field, but running | makemv delim="," fieldname after the coalesce statement puts the commas back.</P> Thu, 18 Oct 2012 18:25:26 GMT responsys_cm 2012-10-18T18:25:26Z https://community.splunk.com/t5/Splunk-Search/Coalesce-and-multivalued-fields/m-p/92641#M23921 <P>I'm seeing some weird issues with using coalesce in an eval statement with multivalued fields. Prior to the eval statement, if I export the field to a lookup table, the field's data looks like:</P> <P>"1234,<BR /><BR /> 5678,<BR /><BR /> 9876,<BR /><BR /> 3456"</P> <P>If I do use coalesce to combine the first non-null value of one of these multivalued fields, the output in the lookup table looks like:</P> <P>"39750 </P> <P>39751 </P> <P>39752 </P> <P>39753 </P> <P>39754 </P> <P>45878", </P> <P>Searches that reference that field in the lookup table come back with an error: </P> <P>Empty csv lookup file (contains only a header) for table 'nessus_plugin_reference_lookup': C:\Program Files\Splunk\etc\apps\ResponsysSecurityConsole\lookups\nessus_plugin_reference_lookup.csv </P> <P>But the lookup table is like 30 MB in size. If I drop the field created by the coalesce statement, there aren't any problems.</P> <P>How can I turn the post-coalesce field back into something that conforms to the normal multi-valued field? I've tried things like | makemv delim="\n" or | makemv delim="$", but that doesn't break up the data correctly.</P> <P>I've also tried using rex after the coalesce statement to match on \d+ with an appropriate max_match=X value, but the field still isn't comma separated within quotes when output to a lookup table.</P> <P>Thx.</P> <P>Craig</P> Wed, 17 Oct 2012 04:20:57 GMT https://community.splunk.com/t5/Splunk-Search/Coalesce-and-multivalued-fields/m-p/92641#M23921 responsys_cm 2012-10-17T04:20:57Z https://community.splunk.com/t5/Splunk-Search/Coalesce-and-multivalued-fields/m-p/92642#M23922 <P>I still don't know why coalesce removes the commas that delimit a multivalued field, but running | makemv delim="," fieldname after the coalesce statement puts the commas back.</P> Thu, 18 Oct 2012 18:25:26 GMT https://community.splunk.com/t5/Splunk-Search/Coalesce-and-multivalued-fields/m-p/92642#M23922 responsys_cm 2012-10-18T18:25:26Z