Custom command to generate table from multivalue events example for wsus data: | mvtable mvfields='kbnumber,arrival_date' keepfields='host,OS,_time' | table * mvfields: fields containing several values, cardinality of the first field in the list is assumed to be the desired number of output rows. keepfields: specify the single value fields to be retained on each resulting row. Example from the screenshot: | makeresults | eval kbnumber='1234 5678 9012' | eval arrival_date='2019.05.17 2019.05.17 2019.05.17 2019.05.17' | eval host='test' | eval OS='Windows 10' | eval kbnumber=split(kbnumber,' ') | eval arrival_date=split(arrival_date,' ') | mvtable mvfields='kbnumber,arrival_date' keepfields='host,OS,_time' | table *