Feature/mvcombine

[srikanthpadakanti]

Description

This change introduces the mvcombine PPL command, which combines values of a specified field across rows that are identical on all other fields in the current result set.

mvcombine behaves as a pipeline-level grouping operator: it collapses matching rows into a single row and aggregates the target field values into a multivalue field, while preserving all non-target fields.

Command
mvcombine [delim=""]

Arguments

field (required)
The field whose values will be combined.

• Must be a direct field reference.
• Must be a single-valued (scalar) field.
• If the field does not exist in the current schema, the command fails.

delim (optional)
Delimiter to be used when rendering a single-value representation of the combined field.

• Defaults to a single space (" "), consistent with Splunk.
• Accepted for forward compatibility.
• Has no observable effect in this implementation, since nomv is not yet supported.

Semantics

mvcombine operates on the current result set.

Rows are grouped where all fields except have identical values.

For each group:

• All non-target fields are preserved.
• The target becomes a multivalue array containing the combined values.
• Grouping is not limited to adjacent rows; all matching rows in the result set are combined.
• Value order is preserved from the input stream order at the point where mvcombine executes.
• Users must apply sort before mvcombine if deterministic ordering is required.
• Rows missing the target field do not contribute a value to the combined output.
• If the target field does not exist or is not a direct field reference, the command fails with an error.

Scope clarification

• This PR implements multivalue output only, which is the default and primary behavior in Splunk.
• nomv support (single-value string output using delim) is out of scope for this change and will be introduced separately.
• The delim argument is parsed and validated for syntax parity and forward compatibility, but does not affect output in this implementation.

Related Issues

Resolves #4766
#4766

Check List

• [ X] New functionality includes testing.
• [ X] New functionality has been documented.
• [ X] New functionality has javadoc added.
• [ X] New functionality has a user manual doc added.
• [ X] New PPL command checklist all confirmed.
• [ X] API changes companion pull request created.
• [ X] Commits are signed per the DCO using --signoff or -s.
• [ X] Public documentation issue/PR created.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[srikanthpadakanti]

@ykmr1224 @anasalkouz
I’m trying to get this change merged into the 3.5 release. Could you please run the workflows and let me know if you have any comments or concerns on the code?

[yuancu]

Thanks for the change!

[opensearch-trigger-bot]

The backport to 2.19-dev failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/sql/backport-2.19-dev 2.19-dev
# Navigate to the new working tree
pushd ../.worktrees/sql/backport-2.19-dev
# Create a new branch
git switch --create backport/backport-5025-to-2.19-dev
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 92e73ead7c05c97668510de5cae246bdfdcff394
# Push it to GitHub
git push --set-upstream origin backport/backport-5025-to-2.19-dev
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/sql/backport-2.19-dev

Then, create a pull request where the base branch is 2.19-dev and the compare/head branch is backport/backport-5025-to-2.19-dev.

[LantaoJin]

Thanks for your contribution, merged to main