We have the Bro add-on installed and everything is being parsed into the proper fields. The Bro DNS logs (sourcetype=brodns) have a field called "answers". The value in this field can contain multiple values, all comma delimited (i.e. 10.10.10.1,10.10.10.2,10.10.10.3). I do not have access to the backend (props.conf and transforms.conf) to make the proper changes in those files. I have tried multiple times through the UI via a Transformation field, but nothing I seem to do creates a new multivalue field (new field would be "dnsanswers").
Thank you for the quick response. I understand we can do it via search, but is there no way to make it a permanent field through the UI Transformations Field page? Or can it only be made permanent by manually updating the props and transforms files?