I need to expand multiple MV fields in Splunk. The answers here work if each field in a row has the same cardinality. One of the fields in my dataset sometimes has a single value - NULL - in which case Splunk does not include the entire row.
How can I make Splunk include it as well?
1 Answer
Answer can be found here below. Basically, only do the parts of the query that involve the maybe-null field if the field is not null :)
