Create a table from a multivalue field

[maurelio79]

Hi to all, i need to create a table for a multivalue event. Event is like:

field1=value1, field2=value2, field3="valueA,valueB,valueC,"

i need to create a table like

value1, value2, valueA
value1, value2, valueB
value1, value2, valueC

So i need to exapand to multivalue e create a row in the table for each value of field3.
mvexpand seems what i need, but at the and the table is something like:

    value1, value2, valueA
                    valueB
                    valueC

Can someone please help me?

Thanks and regards

[493669 · Accepted solution]

try this:

...|makemv field3 delim=","|mvexpand field3

try this run anywhere search:

|makeresults|eval field1="value1", field2="value2", field3="valueA,valueB,valueC"|makemv field3 delim=","|mvexpand field3

[maurelio79]

Nice!! Thanks you! I tried mvexpand or makemv, but not together.
Thanks!