Splunk Search

Why does "mvexpand X" remove events with X=NULL?


Why does mvexpand X remove events with X=NULL? As simple as that. It's illogical from my perspective, unless it's on purpose.

thank you!

Tags (1)

Esteemed Legend

Either way of behaving makes some sense but, IMHO the way that it actually work makes more sense than the other.
Either way it could have worked, could easily be converted to the other.
In this case, just do this:

... | eval X = coalesce(X, "ImpossibleValueToDropLater")
| mvexpand X
| eval X = if(X="ImpossibleValueToDropLater", null(), X)


You're the best! Thanks. I decided to write less code but convert null values to strings, as posted in https://answers.splunk.com/answers/548304/mvexpand-gives-less-results.html:

eval username=coalesce(username,"") | mvexpand username
0 Karma

Esteemed Legend

If this worked for you, click "Accept" to close the question.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!