How to create a new multivalue field based of answers field?

[nb1030]

We have the Bro add-on installed and everything is being parsed into the proper fields. The Bro DNS logs (sourcetype=bro_dns) have a field called "answers". The value in this field can contain multiple values, all comma delimited (i.e. 10.10.10.1,10.10.10.2,10.10.10.3). I do not have access to the backend (props.conf and transforms.conf) to make the proper changes in those files. I have tried multiple times through the UI via a Transformation field, but nothing I seem to do creates a new multivalue field (new field would be "dns_answers").

I figured this would work, but it doesn't:

Regular expression:   ( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Format:   dns_answers::$1
Source Key:   answers
Multivalue check box is checked.

What am I doing wrong?

[kmorris_splunk]

Try using the split command in your searches. Something like the following:

| makeresults 
| eval commadelim="value1, value2, value3" 
| eval newmvfield=split(commadelim,",")

[nb1030]

Thank you for the quick response. I understand we can do it via search, but is there no way to make it a permanent field through the UI Transformations Field page? Or can it only be made permanent by manually updating the props and transforms files?