mvzip + mvexpand trick for fields of different cardinalities

Question

I need to expand multiple MV fields in Splunk. The answers here work if each field in a row has the same cardinality. One of the fields in my dataset sometimes has a single value - NULL - in which case Splunk does not include the entire row.

https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html https://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields.html

How can I make Splunk include it as well?

Answer 1

Answer can be found here below. Basically, only do the parts of the query that involve the maybe-null field if the field is not null :)

https://answers.splunk.com/answers/514853/mvexpand-multiple-multi-value-fields-that-may-be-n.html#answer-514877