mvexpand acts like a filter?

[responsys_cm]

I'm building an app to manage Nessus vulnerability data and grab CVE data from the National Vulnerability Database (NVDB). The search does the following:

Searches for all Nessus plugin scripts

Dedupes events by Nessus ID

Replaces a number of field values to make them human readable

Performs a lookup by Nessus ID and returns any CVE IDs associated with the plugin

Some plugins have one or more CVE IDs. Some don't have any. When I pipe that search to the mvexpand command, events without CVE IDs disappear from the search results.

Is there an easy way to make the mvexpand command conditional only on events that have a CVE ID?

Thanks.

Craig

[vbumgarner]

This is old, so I'm sure you've figured it out, but a question deserves an answer...

You need to use

fillnull value="-" CVEID 

before the mvexpand to not lose records that have no CVEID value.