Splunk Search

mvexpand multiple multi-value fields that may be null

ronykrell4694
Explorer

The answer here
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

works if all the mv fields will always be present.
In my dataset, one field is either missing or MV. How can I incorporate it to the solution in the answer?

1 Solution

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

View solution in original post

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

briancronrath
Contributor

Can you just use fillnull and set it to a dummy value or empty space value?

0 Karma

ronykrell4694
Explorer

Doesn't work. Rows where a bunch of fields are MV and one field is null are not processed properly - even if the null field has a fillnull to a dummy value.

To be clear - the complicating factor is that this field is sometimes Null but sometimes MV.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...