https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439731#M125073 <P>Hi ,</P> <P>I want to expand as erach event for the attached example<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5135iF2AFA1183658E5E0/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 07 Jun 2018 07:04:47 GMT Rajkumarkbm2 2018-06-07T07:04:47Z https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439731#M125073 <P>Hi ,</P> <P>I want to expand as erach event for the attached example<span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5135iF2AFA1183658E5E0/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 07 Jun 2018 07:04:47 GMT https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439731#M125073 Rajkumarkbm2 2018-06-07T07:04:47Z https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439732#M125074 <P><CODE>mvexpand</CODE> command<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Mvexpand">http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Mvexpand</A><BR /> however it seems like a result of a query, most likely the query / search can be modified to provide your desired result.<BR /> can you share your search query?</P> Thu, 07 Jun 2018 13:46:59 GMT https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439732#M125074 adonio 2018-06-07T13:46:59Z https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439733#M125075 <P>Hi @Rajkumarkbm2,</P> <P>Can you please try following search?</P> <PRE><CODE>YOUR_SEARCH | eval temp = mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(mvzip(hours_target,expectedCycles),threshold),state_Name), state_type),hours_state_duration),state_reason),state_occurences),state_setupExceeded),state_reasonExceeded),state_color) | stats count by _time,machine,shift,start,end,temp | eval hours_target = mvindex(split(temp,","),0), expectedCycles = mvindex(split(temp,","),1), threshold = mvindex(split(temp,","),2), state_Name = mvindex(split(temp,","),3), state_type = mvindex(split(temp,","),4), hours_state_duration = mvindex(split(temp,","),5), state_reason = mvindex(split(temp,","),6), state_occurences = mvindex(split(temp,","),7), state_setupExceeded = mvindex(split(temp,","),8), state_reasonExceeded = mvindex(split(temp,","),9), state_color = mvindex(split(temp,","),10) | fields - temp </CODE></PRE> <P>Note: As I have took fields from your attached screen shot, please make sure all fields mentioned in search.</P> <P>Happy Splunking</P> Thu, 07 Jun 2018 14:04:07 GMT https://community.splunk.com/t5/Splunk-Search/how-to-expand-multi-value-fields-with-different-formats/m-p/439733#M125075 kamlesh_vaghela 2018-06-07T14:04:07Z