How to extract multivalue field values without using the mvexpand command?

[lpolo]

I would like to extract the key=value pairs found in a multivalue field, but without doing mvexpand mvfield.

Note: the multivalue field is created with the split command.

For instance result set after split command:

|eval mvfield=split(mvfield,"&")

Result:

timestamp mvfield=(k1=v1, k2=v2, k3=v3...,kn=vn) 

desired result set without using mvexpand:

 timestamp (k1=v1, k2=v2, k3=v3,...,kn=vn

Thanks,
Lp

[sundareshr · Accepted solution]

Have you looked at extract? Try this

base search | extract pairdelim="&" kvdelim="=" | ...

[lpolo]

Yeah. I forgot about the extract command. It does the trick.

thanks,
Lp

[sundareshr]

Please accept the answer to close it out.