Splunk Search

mvexpand multiple multi-value fields that may be null

ronykrell4694
Explorer

The answer here
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

works if all the mv fields will always be present.
In my dataset, one field is either missing or MV. How can I incorporate it to the solution in the answer?

1 Solution

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

View solution in original post

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

briancronrath
Contributor

Can you just use fillnull and set it to a dummy value or empty space value?

0 Karma

ronykrell4694
Explorer

Doesn't work. Rows where a bunch of fields are MV and one field is null are not processed properly - even if the null field has a fillnull to a dummy value.

To be clear - the complicating factor is that this field is sometimes Null but sometimes MV.

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...