Splunk Search

mvexpand multiple multi-value fields that may be null

ronykrell4694
Explorer

The answer here
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

works if all the mv fields will always be present.
In my dataset, one field is either missing or MV. How can I incorporate it to the solution in the answer?

1 Solution

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

View solution in original post

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

briancronrath
Contributor

Can you just use fillnull and set it to a dummy value or empty space value?

0 Karma

ronykrell4694
Explorer

Doesn't work. Rows where a bunch of fields are MV and one field is null are not processed properly - even if the null field has a fillnull to a dummy value.

To be clear - the complicating factor is that this field is sometimes Null but sometimes MV.

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...