mvexpand multiple multi-value fields that may be null

[ronykrell4694]

The answer here
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

works if all the mv fields will always be present.
In my dataset, one field is either missing or MV. How can I incorporate it to the solution in the answer?

[ronykrell4694 · Accepted solution]

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

[briancronrath]

Can you just use fillnull and set it to a dummy value or empty space value?

[ronykrell4694]

Doesn't work. Rows where a bunch of fields are MV and one field is null are not processed properly - even if the null field has a fillnull to a dummy value.

To be clear - the complicating factor is that this field is sometimes Null but sometimes MV.