About warnings when dividing multiple multi-value data using mvexpand.

[yutaka1005]

In the following search I divide data with multiple multi-value fields into one line at a time.

See this answer ↓
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

| eval reading=mvzip(multi_value_field1, multi_value_field2) | eval reading=mvzip(reading, multi_value_field3) | eval reading=mvzip(reading, multi_value_field4) | mvexpand reading | makemv reading delim="," | eval field1=mvindex(reading, 0) | eval field2=mvindex(reading, 1) | eval field3=mvindex(reading, 2) | eval field4=mvindex(reading, 3) | ...

The result is OK with this search, but somehow the warning "Field 'reading' does not exist in the data." Is displayed.
Is there a way to avoid this warning?

my splunk ver : 6.5.3

[DalJeanis · Accepted solution]

Okay, assuming you have the same number of values for each multivalue field, there is a simpler method. And I'm annoyed that it's taken me six months to figure it out, all the while doing that complicated mvzip two-step.

Do this instead...

| eval myFan=mvrange(0,mvcount(field1))
| mvexpand myFan
| eval field1=mvindex(field1,myFan)
| eval field2=mvindex(field2,myFan)
| eval field3=mvindex(field3,myFan)
| eval field4=mvindex(field4,myFan)

[gsrivastava]

@DalJeanis Are you assuming here that all the events have just 4 values in a multi-valued field? What if , each event has different no. of values?

[DalJeanis]

@gsrivastava - The number 4 comes from the fact that there were four fields that were mvzipped together in @yutaka1005's example. The only assumption is that each of the four fields has the same number of values... although if not, then a backstop is that field1 is the field with the MOST values.

[gsrivastava]

Facing the same issue @yutaka1005 . Did you find any solution?