How to extract Multivalue fields?

[shrek]

Lets just say I have multiple events like this:

names	John Sam Todd
favorite_colors	Blue Yellow Green

Each event might have a different number of field values but the ratio of names to favorite_colors is 1:1.

Is it possible to extract these into new events or display them separately in a table like this:

name	favourite_color
John	Blue
Sam	Yellow
Todd	Green

I have tried mvexpand but that only works for 1 multivalue field.

[ITWhisperer · Accepted solution]

As you say, mvexpand works on one event, so there are a couple of ways to do it, here is one

| eval row=mvrange(0,mvcount(name))
| mvexpand row
| eval name=mvindex(name,row)
| eval favourite_colour=mvindex(favourite_colour,row)
| fields - row

[shrek]

This was exactly what I was looking for, thanks.