How do you create several multivalued fields?

[MaryvonneMB]

Hi all,

I have several events like this:

Field_A // Field_B // Field_C
A // 1 // z
A // 2 // z
B // 3 // y
B // 4 // x

I would like to create two multivalued fields from Field_B and Field_C relative to Field_A, like this:

Field_A // Field_B // Field_C
A // 1::2 // z
B // 3::4 // y::x

I try mvcombine, but it works only when I have Field_A and Field_B (or Field_A and Field_C). I didn't find how to use it with several fields.

Thank you for any help

[niketnilay · Accepted solution]

@MaryvonneMB how about

  <yourMainSearch>
  | stats values(Field_B) as Field_B values(Field_C) as Field_C by Field_A

[MaryvonneMB]

Thank you very much. I didn't though about stats values. I use mvjoin after to add separator I want and it works well 🙂