| appendcols [ search .... ] works ... View more

This regex is pretty confusing to me. You have ?P but no name for the capturing group. Is there a purpose for the presence of the ?P at the start of each group? Perhaps our unhelpful markdown interpreter ate the <fieldname> component. In any event, there are several scenarios in which the visual display of an empty-space value of a field will not be satisfying. Are you sure the field is not present? Try putting a character on the end of each value to test, such as with |eval myfield=myfield . "x" ... View more

The delimiters used by makemv etc are instructions on how to take a string and identify multiple values within it. In-memory, there simply multiple string values for the field, without any delimeters. When we serialize the multivalue fields to csv, typically there are two reprsentations, one representation acts as a hint that there is a multivalue field, and the other representation is newline-delimited. This is true for data passed to a python search command, or when using the |outputcsv command. I'm not familiar with what you get when using the in-gui "export" feature with multivalue fields. In the current implementation, the system actually tracks a single-value string and a multi-value set of values for a field that is multivalue, so we may provide the single-value string when exporting even though we will ignore it. (If relevant, this is an implementation wart which will eventually go away.) ... View more