i have search query that seperate multivalue and expand them into various result. It work for entry that has data but will ignore those empty change which i also want it to display .. Here is the sample data user Mail_diff GMail_diff Opt_diff A NULL NULL NULL B X to Y Z to 1 4 to 5 C NULL NULL this to that then my search query is following index="post-user" NOT "POST*" | eval new = if (GMail_diff != "NULL", "GMail_diff--".GMail_diff,"") | eval new2 = if (Mail_diff != "NULL", "Mail_diff--".Mail_diff,"") | eval new3 = if (Opt_diff != "NULL", "Opt_diff--".Opt_diff,"") | eval Changed = new."/".new2."/".new3."/ |makemv Changed delim="/" |mvexpand Changed|eval z= split(Changed,"to")| eval before = mvindex(z,0) | eval after =mvindex(z,-1) |table before,after,user This query search the index post-user, i use eval to select field that is not NULL and put them into different variable first, then if it is empty then ignore. Then i concatenate them with "/" and make them into multiple value again. Then i expand then so that each _diff become new row. The last part i use split function to differentiate between before and after. My search result is following: before after user Mail_diff -- X Y B Mail_diff -- Z 1 B Mail_diff -- 4 5 B Opt_diff -- this that C I am unable to include user A!! .. which i need it as well.. ideally, is like that.. before after user A Mail_diff -- X Y B Mail_diff -- Z 1 B Mail_diff -- 4 5 B Opt_diff -- this that C Anyone, has any idea? ... View more

Hi, i am trying to use regex to extract field.. and i facing some problem when it has null value on the field.. i will give example on the following: field1 field2 field3 AAAAA BBBBB CCCCC DDDDD EEEEE FFFFF GGGGG HHHHH i use regex in my transform.conf as follow [transform-impressio] REGEX = (.{5})(.{12})(.{17}) FORMAT = field1::"$1" field2::"$2 field3::"$3 Basically this regex does for everything from the first 5 character belong to field1 and next 12 belong to field 2 and next 17 belong to field 3 However, when i search on splunk it return me. field1 field 2 field 3 AAAAA BBBBB CCCCC DDDDD EEEEE it missing the another 2 row And i understand it is because that if it has empty space on last field then this regex couldn't work!!.. anyone has good suggestion on it? thanks ... View more

i working on a query to display fields with data others than the string "NULL".. and i am trying to use eval. eval new_field=if(field1 !="NULL" "field1--".value1."field2--".value2, field2) then continue for the next eval.. then pipe to next eval. However, i cannot get the result out.. is it my syntax error? ... View more