Is there a way to format a string when it's used to fillnull?

[bhavlik]

I have created a dashboard that is monitoring the number of events received at corporate to the number of events reported on a client's database.   This way we can be alerted when we have not received all events and can log into the client's database and manually pull that file.   

Here's a partial screenshot of the current dashboard:

Here is the search that produces the above dashboard:

| makeresults 
| fields - _time 
| eval eventName="CustCkIn,CustCkOut,EduAssigned,EduView,FTGChannelOff,NavHdiInteractive,PatientInfo,SncChromecastState,StayIdCrossReference,SurveyResponse,SysConfigRoomInfo," 
| makemv delim="," eventName 
| mvexpand eventName 
| append 
    [| inputlookup EventValidationMonitoring.csv 
    | addinfo 
    | eval _time=strptime(date,"%Y-%m-%d") 
    | where _time>=info_min_time AND _time<relative_time('info_min_time',"+604800") AND propertyId=0123456
    | eval ValidationData=mvappend("nVerify=".nVerifyEvents,"nProperty=".nPropertyEvents,"nReceived=".nReceivedEvents,"Missing=".Missing) 
    | table date eventName ValidationData 
    | eval {date}=ValidationData 
    | fields - date ValidationData ] 
| stats values(*) as * by eventName
| fillnull value="Missing=Undetermined, nProperty=NA, nReceived=0, nVerify=0"

Is there a way I can format the fillnull string so that it has the same format as the other cells?

[bowesmana · Accepted solution]

@bhavlik 

Replace your fillnull string with this

| fillnull value="Missing=Undetermined,nProperty=NA,nReceived=0,nVerify=0"
| foreach 2* [ eval <<FIELD>>=if(mvcount('<<FIELD>>')=1,split('<<FIELD>>',","),'<<FIELD>>') ]

 This just puts your fillnull string then splits it up to the multivalue field as the others. 

[bhavlik]

Thank you!  This looks great!