Timestamp for multivalue fields that had been split up

[jiakslim]

Hey there,

I have a question regarding timestamps for multivalue fields that have been splitted up. Initially, my lines were as such: x =[a, b, c, d, e, f, g]. I trimmed away the square brackets by the side and subsequently had them broken up into single value fields. All entries (a, b, c, d, e, f, g) have the same timestamp. However, the problem is that currently only "a" has a timestamp. Everything else doesn't have a timestamp.

Is there a way to which I can insert the same timestamp for all other entries?

Thanks

[jiakslim]

Hey niketnilay - yes absolutely, just _time and x. Thanks for the help, everything above worked. And thanks for the advice, I'll include these information in my future questions.
Thanks a million!

[niketn]

@jiakslim, you might have to put in more details of what is the raw event data you are working with and what is the query you have tried with current output and what is not working for us to help you better.

Meanwhile, if you have multi-valued field x and you are interested only in _time and x, you should just try using | mvexpand x as your final pipe. Following is a run anywhere example based on information provided so far.

| makeresults 
| eval x ="[a, b, c, d, e, f, g]"
| eval x=replace(x,"(\[|\])","")
| makemv x delim=","
| mvexpand x