Splunk Search

Why does "mvexpand X" remove events with X=NULL?

macoo
Explorer

Why does mvexpand X remove events with X=NULL? As simple as that. It's illogical from my perspective, unless it's on purpose.

thank you!

Tags (1)

woodcock
Esteemed Legend

Either way of behaving makes some sense but, IMHO the way that it actually work makes more sense than the other.
Either way it could have worked, could easily be converted to the other.
In this case, just do this:

... | eval X = coalesce(X, "ImpossibleValueToDropLater")
| mvexpand X
| eval X = if(X="ImpossibleValueToDropLater", null(), X)

nick405060
Motivator

You're the best! Thanks. I decided to write less code but convert null values to strings, as posted in https://answers.splunk.com/answers/548304/mvexpand-gives-less-results.html:

eval username=coalesce(username,"") | mvexpand username
0 Karma

woodcock
Esteemed Legend

If this worked for you, click "Accept" to close the question.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...