How can I properly index empty and blank space values in a multivalue field?

[tcmarquesi]

Hi all.

Each event in my logfile are like instructions that log multiple actions at once. Then I made a transform to extract and build a multivalue field to index them (action, parm and ans). However, some of these fields can assume eventually empty "" or blank-space " " as values, for example:

tstamp="20151024 00:00:00.333"
port=port1
system=system1
mainkey=03CSDF39B539B5
action="w";parm="D058";ans="O"
action="A";parm="";ans="ERROR"
action="C";parm="A06F";ans=""
action="C";parm="D06E";ans=""

If I search mvcount(action) in the example, it returns 4, but mvcount(parm) returns 3. If I search mvindex(action,1), it returns "A", OK, but mvindex(parm,1), it returns A06F instead of "". Splunk didn't build the array properly.

So, what do I have to do to Splunk to accept empty and blank spaces as possible (and useful) values in order to solve this problem?

Thanks!

[lguinn2]

Multivalue fields do not form tables; each field is an independent list. When Splunk parses

action="A";parm="";ans="ERROR"

it will assign the value "null()" to the parm field. So the second value of the parm field is A06F as you saw.

You can try the fillnull command, but I don't know how that will affect a multi-valued field - as Splunk does not consider the parm field to be null since it has three values.

The best solution, if you have the ability to do it, is probably to make every field have a value. Declare a value such as "n/a" that can be used to indicate a purposefully empty field.