I have several fields I want to lump into 1 multivalue field and remove blanks.
At the start of an event, there are up to 6 IP Addresses, either internal or external, but not both (they are the source IP, plus any LB hops along the way). They get extracted to either internal_src_ip# or external_src_ip#. If it is an internal IP, then the external_src_ip# will be "-", i.e. blank.