Splunk Search

mvexpand multiple multi-value fields that may be null

ronykrell4694
Explorer

The answer here
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

works if all the mv fields will always be present.
In my dataset, one field is either missing or MV. How can I incorporate it to the solution in the answer?

1 Solution

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

View solution in original post

ronykrell4694
Explorer

I figured it out using the case command. Using the trick in the linked answer, only mvzip the field if it is not null. Otherwise, do not change the mvzipped variable. In this case, test_message is the field that is sometimes MV and sometimes null.

| eval test_specific_vals=case(!isnull(test_message),mvzip(test_specific_vals,test_message,"&"),isnull(test_message),test_specific_vals)

Same type of thing at the end of the query when assigning to variables

| eval test_msg = case(!isnull(test_message),mvindex(test_specific_vals,4))

briancronrath
Contributor

Can you just use fillnull and set it to a dummy value or empty space value?

0 Karma

ronykrell4694
Explorer

Doesn't work. Rows where a bunch of fields are MV and one field is null are not processed properly - even if the null field has a fillnull to a dummy value.

To be clear - the complicating factor is that this field is sometimes Null but sometimes MV.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...