How do I get mvcount to display 0 when no field exists?

[DamianS]

Hi all,

I have a search that looks something like this:

foo | extract pairdelim="|;]}" kvdelim="=:" mv_add=true | eval legs=mvcount(Leg)+1 | stats count by id, legs

The multi value field "Leg" has one of the 3 possible values "", "2", "2 3". I expected mvcount to work like count and when there are no values to display 0. Is there a way to display what I would I expect? Explicitly the mapping I wanted to do was from the multi value field "Leg": No Value -> 1, "2" -> 2, "2 3" -> 3

Any idea?

[cphair]

The documentation says mvcount returns the number of values of the field if it's multivalued, 1 if it's singlevalued, and NULL otherwise. Given the mapping you describe, I think you want to do something like this:

...  | eval legs=if(isnull(Leg),1,mvcount(Leg)+1)

[cphair]

You're welcome, @DamianS. Would you mind clicking the checkmark next to my answer to accept it? Thanks.

[DamianS]

Perfect! Thanks for your help!