Each event in my logfile are like instructions that log multiple actions at once. Then I made a transform to extract and build a multivalue field to index them (action, parm and ans). However, some of these fields can assume eventually empty "" or blank-space " " as values, for example:
If I search mvcount(action) in the example, it returns 4, but mvcount(parm) returns 3. If I search mvindex(action,1), it returns "A", OK, but mvindex(parm,1), it returns A06F instead of "". Splunk didn't build the array properly.
So, what do I have to do to Splunk to accept empty and blank spaces as possible (and useful) values in order to solve this problem?