nomv

The nomv command converts a multivalue (array) field into a single-value string field by joining all array elements with newline characters (\n). This operation is performed in place, replacing the original field with its joined string representation.

The field must be an array type. For scalar fields, use the array() function to convert the value into an array first.

Syntax

The nomv command has the following syntax:

nomv <field>

Parameters

The nomv command supports the following parameters.

Example: Convert a collected list to a single-value string

The following query collects all service names into an array. It then filters to include only services that reported errors and converts the array into a string:

source=otellogs
| where severityText = 'ERROR'
| stats list(`resource.attributes.service.name`) as affected_services by severityText
| nomv affected_services
| fields severityText, affected_services

The query returns the following results:

Limitations

The nomv command has the following limitations:

• The nomv command is only available when the Apache Calcite query engine is enabled.
• The newline delimiter (\n) is fixed and cannot be customized. For custom delimiters, use the mvjoin function directly in an eval expression.
• NULL values within the array are automatically filtered out and do not appear in the output.

Related commands

• mvcombine – Combines multiple rows into a single row with multivalue fields.
• mvexpand – Expands multivalue fields into separate rows.