[FEATURE] Add mvcombine command in PPL

[srikanthpadakanti]

Proposal — Command syntax, options, and precise semantics

Command
mvcombine <field> [delim="<string>"]

Arguments

field (required)

The name of the field whose values will be combined.

• Must be a direct field reference.
• Must be a single-valued (scalar) field.
• If the field does not exist in the current schema, the command fails.

delim (optional)

Defines the delimiter to be used when rendering a single-value representation of the combined field.

• Default: a single space (" "), consistent with Splunk.
• Ignored unless nomv is implemented and used.
• Present for syntax compatibility with Splunk and forward extensibility.

---

Precise semantics

mvcombine operates on the current result set produced by the pipeline.

Grouping rules

Rows are grouped where all fields except <field> have identical values.

• Grouping is not limited to adjacent rows.
• All rows in the current result set are considered.

For each group

• All non-target fields are preserved as group keys.
• <field> becomes a multivalue field containing the combined values from the group.

Value inclusion

• Rows where the target field is missing or null do not contribute a value to the combined output.
• Rows that differ only by the target field are collapsed into a single output row.

Ordering

• Value order in the multivalue field follows the input stream order at the point where mvcombine executes.
• If deterministic ordering is required, users must apply sort before mvcombine.

Error handling

The command fails with an error if:

• The target field does not exist in the current schema.
• The target is not a direct field reference.
• The target field is already a multivalue (array) type.

Examples

1. Basic
   Input:
   | user | action | id |
   | joe | login | 1 |
   | joe | login | 2 |
   | joe | logout | 3 |

Query:
... | mvcombine id

Output:
| user | action | id |
| joe | login | [1,2] |
| joe | logout | [3] |

2. Non-consecutive
   Input:
   | user | action | id |
   | joe | login | 1 |
   | sam | login | 5 |
   | joe | login | 2 |

Query:
... | mvcombine id

Output:
| user | action | id |
| joe | login | [1,2] |
| sam | login | [5] |

3. Missing target field
   Input:
   | user | action | id |
   | joe | login | 1 |
   | joe | login | |
   | joe | login | 2 |

Query:
... | mvcombine id

Output:
| user | action | id |
| joe | login | [1,2] |

Rows missing the target field do not contribute values.

---

[dai-chen]

@srikanthpadakanti Thanks for opening this issue! Could you update it to follow our RFC template and add the missing sections? To align on scope and requirements, please include:

1. Proposal — Command syntax, options, and precise semantics - for example, your draft uses delimeter, shall we use delim? Is return value array or string?
2. Approach — Any implementation limitations in PPL; a short-term/long-term plan if applicable.
3. Implementation discussion
   • Is this command a subset or composition of existing commands?
   • What are the equivalent SQL statement(s)?
   • Can this be pushed down to OpenSearch DSL, and under what conditions?

[srikanthpadakanti]

@srikanthpadakanti Thanks for opening this issue! Could you update it to follow our RFC template and add the missing sections? To align on scope and requirements, please include:

1. Proposal — Command syntax, options, and precise semantics - for example, your draft uses delimeter, shall we use delim? Is return value array or string?

2. Approach — Any implementation limitations in PPL; a short-term/long-term plan if applicable.

3. Implementation discussion

   • Is this command a subset or composition of existing commands?
   • What are the equivalent SQL statement(s)?
   • Can this be pushed down to OpenSearch DSL, and under what conditions?

Hello @dai-chen Thanks — I updated the issue with an RFC-style Proposal / Approach / Implementation section and examples.
Recommended defaults: delim, default → array (if delim present → string), preserve nulls, single-field per invocation.
Please confirm: delim vs delimiter, null handling policy, and memory-cap behavior.

[dai-chen]

Only consecutive (adjacent) rows are combined ...

Could you confirm this? I don't see it in SPL's documentation. I did quick test and it seems not so.

| makeresults format=json data="[
  {\"ip\":\"A\", \"packets\":10},
  {\"ip\":\"B\", \"packets\":60},
  {\"ip\":\"A\", \"packets\":20},
  {\"ip\":\"C\", \"packets\":30}
]" | mvcombine packets

A - [10, 20]
B - 60
C 30