topic Re: Multivalue fields in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600583#M209070 <P>This was exactly what I was looking for, thanks.</P> Sun, 05 Jun 2022 03:04:52 GMT shrek 2022-06-05T03:04:52Z How to extract Multivalue fields? https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600581#M209068 <P>Lets just say I have multiple events like this:</P> <TABLE border="1" width="99.61088709677418%"> <TBODY> <TR> <TD width="50%">names</TD> <TD width="49.612569809118945%"> <P>John</P> <P>Sam</P> <P>Todd</P> </TD> </TR> <TR> <TD width="50%">favorite_colors</TD> <TD width="49.612569809118945%"> <P>Blue</P> <P>Yellow</P> <P>Green</P> </TD> </TR> </TBODY> </TABLE> <P>Each event might have a different number of field values but the ratio of <STRONG>names </STRONG>to&nbsp;<STRONG>favorite_colors </STRONG>is 1:1.</P> <P>Is it possible to extract these into new events or display them separately in a table like this:</P> <TABLE border="1" width="100%"> <TBODY> <TR> <TD width="50%">name</TD> <TD width="50%">favourite_color</TD> </TR> <TR> <TD width="50%">John</TD> <TD width="50%">Blue</TD> </TR> <TR> <TD width="50%">Sam</TD> <TD width="50%">Yellow</TD> </TR> <TR> <TD width="50%">Todd</TD> <TD width="50%">Green</TD> </TR> </TBODY> </TABLE> <P>&nbsp;</P> <P>I have tried mvexpand but that only works for 1 multivalue field.</P> Mon, 06 Jun 2022 03:41:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600581#M209068 shrek 2022-06-06T03:41:42Z Re: Multivalue fields https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600582#M209069 <P>As you say, mvexpand works on one event, so there are a couple of ways to do it, here is one</P><LI-CODE lang="markup">| eval row=mvrange(0,mvcount(name)) | mvexpand row | eval name=mvindex(name,row) | eval favourite_colour=mvindex(favourite_colour,row) | fields - row</LI-CODE> Sun, 05 Jun 2022 02:23:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600582#M209069 ITWhisperer 2022-06-05T02:23:14Z Re: Multivalue fields https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600583#M209070 <P>This was exactly what I was looking for, thanks.</P> Sun, 05 Jun 2022 03:04:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-Multivalue-fields/m-p/600583#M209070 shrek 2022-06-05T03:04:52Z