Simple way to turn multivalue field into a table?

[alexander_lucas]

Is the a function that does this:

... | mvmap data (fname, lname, age, height) | table lname, age

(where data is a multivalue field)

[gkanapathy · Accepted solution]

No. You probably need something like:

... | fields lname age | eval z=mvzip(lname,age,":") | mvexpand z | eval z=split(z,":") | eval lname=mvindex(z,0) | eval age=mvindex(z,1) | fields - z

[_jgpm_]

https://answers.splunk.com/answers/370008/is-it-possible-to-turn-a-multivalued-field-with-an.html