mvexpand multiple fields

[michaelrosello]

Is there a way to use mvexpand on multitple values?

This is the result of my current search and I want it to look like this below. Note that there will multiple multivalue fields so i cannot use the mvzip or can I?

SESSIONID    Timstamp    Value1   Value2  Value3 
1             06/21        1         2      3 
1             06/22        2         3      4

[493669]

First use mvzip the multi-values into a new field:

 | eval total=mvzip(value1, value2)    // create multi-value field using value1 and value2
 | eval total=mvzip(total, value3)  // add the third field

Now, Expand the field and restore the values:

 | mvexpand total                    // separate multi-value into into separate events
 | makemv total delim=","            // convert the reading into a multi-value
 | eval value1=mvindex(total, 0)      // set value1 to the first value of total
 | eval value2=mvindex(total, 1)      // set value2 to the second value of total
 | eval value3=mvindex(total, -1)     // set value3 to the last value of total

[ryhluc01]

The -1 @ the end is recapturing the second result instead of the last. To fix this just remove the "-" in the last eval.

[ryhluc01]

Can you close out this question by choosing @493669 answer?

[madan27]

Please check this solution: https://answers.splunk.com/answers/724138/

[FrankVl]

To what extend would such an approach risk mixing up the connection between different 'rows' in the multi valued fields? Can you be sure that the first entry in multi valued field1 corresponds with the first entry in multi valued field2?

Might be safer to extract it as 1 field to begin with, then expand and only then split out to the individual fields?