https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371745#M109385 <P>Facing the same issue @yutaka1005 . Did you find any solution?</P> Thu, 05 Oct 2017 05:46:19 GMT gsrivastava 2017-10-05T05:46:19Z https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371744#M109384 <P>In the following search I divide data with multiple multi-value fields into one line at a time.</P> <P>See this answer ↓<BR /> <A href="https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html" target="_blank">https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html</A></P> <P>| eval reading=mvzip(multi_value_field1, multi_value_field2) | eval reading=mvzip(reading, multi_value_field3) | eval reading=mvzip(reading, multi_value_field4) | mvexpand reading | makemv reading delim="," | eval field1=mvindex(reading, 0) | eval field2=mvindex(reading, 1) | eval field3=mvindex(reading, 2) | eval field4=mvindex(reading, 3) | ...</P> <P>The result is OK with this search, but somehow the warning "Field 'reading' does not exist in the data." Is displayed.<BR /> Is there a way to avoid this warning?</P> <P>my splunk ver : 6.5.3</P> Tue, 29 Sep 2020 14:39:28 GMT https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371744#M109384 yutaka1005 2020-09-29T14:39:28Z https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371745#M109385 <P>Facing the same issue @yutaka1005 . Did you find any solution?</P> Thu, 05 Oct 2017 05:46:19 GMT https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371745#M109385 gsrivastava 2017-10-05T05:46:19Z https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371746#M109386 <P>Okay, assuming you have the same number of values for each multivalue field, there is a simpler method. And I'm annoyed that it's taken me six months to figure it out, all the while doing that complicated <CODE>mvzip</CODE> two-step.</P> <P>Do this instead...</P> <PRE><CODE>| eval myFan=mvrange(0,mvcount(field1)) | mvexpand myFan | eval field1=mvindex(field1,myFan) | eval field2=mvindex(field2,myFan) | eval field3=mvindex(field3,myFan) | eval field4=mvindex(field4,myFan) </CODE></PRE> Fri, 06 Oct 2017 18:46:55 GMT https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371746#M109386 DalJeanis 2017-10-06T18:46:55Z https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371747#M109387 <P>@DalJeanis Are you assuming here that all the events have just 4 values in a multi-valued field? What if , each event has different no. of values?</P> Mon, 09 Oct 2017 09:53:39 GMT https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371747#M109387 gsrivastava 2017-10-09T09:53:39Z https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371748#M109388 <P>@gsrivastava - The number 4 comes from the fact that there were four fields that were mvzipped together in @yutaka1005's example. The only assumption is that each of the four fields has the same number of values... although if not, then a backstop is that field1 is the field with the MOST values. </P> Tue, 10 Oct 2017 03:52:14 GMT https://community.splunk.com/t5/Splunk-Search/About-warnings-when-dividing-multiple-multi-value-data-using/m-p/371748#M109388 DalJeanis 2017-10-10T03:52:14Z