https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/556834#M158155 <LI-CODE lang="markup">| makeresults | eval _raw="Product,color,description1,description2 phone,blue,location : loc_a|date: date_a|serial_no: serial_a,location : loc_a|date: date_q phone,yellow,location : loc_d|date: date_e|serial_no: serial_f,location : loc_x|date: date_y|serial_no: serial_z phone,green,location : loc_p|date: date_q,location : loc_g|date: date_h|serial_no: serial_i" | multikv forceheader=1 | eval description1=split(description1,"|") | eval description2=split(description2,"|") | fields - _* linecount | eval range=mvrange(0,max(mvcount(description1),mvcount(description2))) | mvexpand range | eval description1=mvindex(description1,range) | eval description2=mvindex(description2,range)</LI-CODE> Wed, 23 Jun 2021 09:04:17 GMT ITWhisperer 2021-06-23T09:04:17Z https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/556823#M158146 <P>Hello,</P><P>Currently encounter 1 issue which unable to split 2 multivalues fields concurrently.<BR /><BR />my table:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="25%" height="24px">Product</TD><TD width="25%" height="24px">color</TD><TD width="25%" height="24px">description1</TD><TD width="25%" height="24px">description2</TD></TR><TR><TD width="25%" height="67px">phone</TD><TD width="25%" height="67px">blue</TD><TD width="25%" height="67px">location : loc_a<BR />date: date_a<BR />serial_no: serial_a</TD><TD width="25%" height="67px">location : loc_a<BR />date: date_q<BR /><BR /></TD></TR><TR><TD width="25%" height="24px">phone</TD><TD width="25%" height="24px">yellow</TD><TD width="25%" height="24px">location : loc_d<BR />date: date_e<BR />serial_no: serial_f</TD><TD width="25%" height="24px">location : loc_x<BR />date: date_y<BR />serial_no: serial_z</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>desired output:</P><TABLE border="1"><TBODY><TR><TD width="140.113px" height="24px">Product</TD><TD width="140.113px" height="24px">color</TD><TD width="140.113px" height="24px">description1</TD><TD width="140.113px" height="24px">description2</TD></TR><TR><TD width="140.113px" height="67px">phone</TD><TD width="140.113px" height="67px">blue</TD><TD width="140.113px" height="67px">location : loc_a<BR /><BR /></TD><TD width="140.113px" height="67px">location : loc_a<BR /><BR /><BR /></TD></TR><TR><TD width="140.113px" height="24px">phone</TD><TD width="140.113px" height="24px">blue</TD><TD width="140.113px" height="24px">date:date_a</TD><TD width="140.113px" height="24px">date: date_q</TD></TR><TR><TD width="140.113px" height="24px">phone</TD><TD width="140.113px" height="24px">blue</TD><TD width="140.113px" height="24px">serial_no: serial_a</TD><TD width="140.113px" height="24px">&nbsp;</TD></TR><TR><TD width="140.113px" height="67px">phone</TD><TD width="140.113px" height="67px">yellow</TD><TD width="140.113px" height="67px">location : loc_d</TD><TD width="140.113px" height="67px">location : loc_x</TD></TR><TR><TD width="140.113px" height="24px">phone</TD><TD width="140.113px" height="24px">yellow</TD><TD width="140.113px" height="24px">date: date_e</TD><TD width="140.113px" height="24px">date: date_y</TD></TR><TR><TD width="140.113px" height="24px">phone</TD><TD width="140.113px" height="24px">yellow</TD><TD width="140.113px" height="24px">serial_no: serial_f</TD><TD width="140.113px" height="24px">serial_no: serial_z</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>im able to find a function called&nbsp; <U><STRONG><FONT color="#FF0000">mvexpand</FONT> </STRONG></U>but sadly it cannot split 2 field.<BR /><BR />Regards,</P><P>Yu Ming</P> Wed, 23 Jun 2021 08:24:03 GMT https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/556823#M158146 yuming1127 2021-06-23T08:24:03Z https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/556834#M158155 <LI-CODE lang="markup">| makeresults | eval _raw="Product,color,description1,description2 phone,blue,location : loc_a|date: date_a|serial_no: serial_a,location : loc_a|date: date_q phone,yellow,location : loc_d|date: date_e|serial_no: serial_f,location : loc_x|date: date_y|serial_no: serial_z phone,green,location : loc_p|date: date_q,location : loc_g|date: date_h|serial_no: serial_i" | multikv forceheader=1 | eval description1=split(description1,"|") | eval description2=split(description2,"|") | fields - _* linecount | eval range=mvrange(0,max(mvcount(description1),mvcount(description2))) | mvexpand range | eval description1=mvindex(description1,range) | eval description2=mvindex(description2,range)</LI-CODE> Wed, 23 Jun 2021 09:04:17 GMT https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/556834#M158155 ITWhisperer 2021-06-23T09:04:17Z https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559006#M158810 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp; , i discovered the solution not work correctly for below case.<BR /><BR /></P><TABLE border="1" width="100%"><TBODY><TR><TD width="25%" height="24px">Product</TD><TD width="25%" height="24px">color</TD><TD width="25%" height="24px">description1</TD><TD width="25%" height="24px">description2</TD></TR><TR><TD width="25%" height="67px">phone</TD><TD width="25%" height="67px">blue</TD><TD width="25%" height="67px">location : loc_a<BR />date: date_a<BR /><FONT color="#FF9900">serial_no: serial_a</FONT><BR /><FONT color="#FF9900">extra_info_a:info_a</FONT><BR /><FONT color="#FF9900">extra_info_b:info_b</FONT></TD><TD width="25%" height="67px">location : loc_a<BR />date: date_q<BR /><FONT color="#339966">extra_info_a: info_c</FONT><BR /><FONT color="#339966">extra_info_b: info_d</FONT><BR /><BR /></TD></TR><TR><TD width="25%" height="24px">phone</TD><TD width="25%" height="24px">yellow</TD><TD width="25%" height="24px">location : loc_d<BR />date: date_e<BR />serial_no: serial_f</TD><TD width="25%" height="24px">location : loc_x<BR />date: date_y<BR />serial_no: serial_z</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>&nbsp;</P><P>Current output: where there are mismatch of field</P><TABLE border="1"><TBODY><TR><TD width="140px" height="24px">Product</TD><TD width="140px" height="24px">color</TD><TD width="152.062px" height="24px">description1</TD><TD width="140px" height="24px">description2</TD></TR><TR><TD width="140px" height="67px">phone</TD><TD width="140px" height="67px">blue</TD><TD width="152.062px" height="67px">location : loc_a<BR /><BR /></TD><TD width="140px" height="67px">location : loc_a<BR /><BR /><BR /></TD></TR><TR><TD width="140px" height="24px">phone</TD><TD width="140px" height="24px">blue</TD><TD width="152.062px" height="24px">date:date_a</TD><TD width="140px" height="24px">date: date_q</TD></TR><TR><TD width="140px" height="46px">phone</TD><TD width="140px" height="46px">blue</TD><TD width="152.062px" height="46px"><STRONG><FONT color="#FF0000">serial_no: serial_a</FONT></STRONG></TD><TD width="140px" height="46px"><STRONG><FONT color="#FF0000">extra_info_a: info_c</FONT></STRONG></TD></TR><TR><TD width="140px" height="22px">phone&nbsp;</TD><TD width="140px" height="22px">blue</TD><TD width="152.062px" height="22px"><STRONG><FONT color="#FF0000">extra_info_a:info_a</FONT></STRONG></TD><TD width="140px" height="22px"><STRONG><FONT color="#FF0000">extra_info_b: info_d</FONT></STRONG></TD></TR><TR><TD width="140px" height="24px">phone</TD><TD width="140px" height="24px">blue</TD><TD width="152.062px" height="24px"><STRONG><FONT color="#FF0000">extra_info_b:info_b</FONT></STRONG></TD><TD width="140px" height="24px">&nbsp;</TD></TR><TR><TD width="140px" height="67px">phone</TD><TD width="140px" height="67px">yellow</TD><TD width="152.062px" height="67px">location : loc_d</TD><TD width="140px" height="67px">location : loc_x</TD></TR><TR><TD width="140px" height="24px">phone</TD><TD width="140px" height="24px">yellow</TD><TD width="152.062px" height="24px">date: date_e</TD><TD width="140px" height="24px">date: date_y</TD></TR><TR><TD width="140px" height="24px">phone</TD><TD width="140px" height="24px">yellow</TD><TD width="152.062px" height="24px">serial_no: serial_f</TD><TD width="140px" height="24px">serial_no: serial_z</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Cannot figure out how to do that, would appreciate if there a clear procedure/solution i can do, thanks</P> Mon, 12 Jul 2021 03:34:33 GMT https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559006#M158810 yuming1127 2021-07-12T03:34:33Z https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559046#M158821 <P>It would have helped if you had made it clearer that the "keys" in the multi-value field had to align!</P><P>Try this</P><LI-CODE lang="markup">| makeresults | eval _raw="Product,color,description1,description2 phone,blue,location: loc_a|date: date_a|serial_no: serial_a|extra_info_a: info_a|extra_info_b: info_b,location: loc_a|date: date_q|extra_info_a: info_c|extra_info_b: info_d phone,yellow,location: loc_d|date: date_e|serial_no: serial_f,location: loc_x|date: date_y|serial_no: serial_z phone,green,location: loc_p|date: date_q,location: loc_g|date: date_h|serial_no: serial_i" | multikv forceheader=1 | eval description1=split(description1,"|") | eval description2=split(description2,"|") | fields - _* linecount | eval keys1=mvmap(description1,mvindex(split(description1,":"),0)) | eval keys2=mvmap(description2,mvindex(split(description2,":"),0)) | eval keys=mvdedup(mvappend(keys1,keys2)) | eval range=mvrange(0,mvcount(keys)) | mvexpand range | eval description1=mvindex(description1,mvfind(keys1,mvindex(keys,range))) | eval description2=mvindex(description2,mvfind(keys2,mvindex(keys,range))) | table Product color description1 description2</LI-CODE> Mon, 12 Jul 2021 08:27:19 GMT https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559046#M158821 ITWhisperer 2021-07-12T08:27:19Z https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559049#M158822 <P>Its worked, great that learned mvmap and mvfind today, thanks alot</P> Mon, 12 Jul 2021 09:01:12 GMT https://community.splunk.com/t5/Splunk-Search/split-2-multivalue-fields-concurrently-split-1-multivalues-row/m-p/559049#M158822 yuming1127 2021-07-12T09:01:12Z