Once multi-value fields are expanded, any relationship among them is lost. They need to be combined into a new field before expansion. ...
| eval new_field = mvzip("participants{}.object_value", "participants{}.role")
| mvexpand new_field
| eval new_field = split(new_field, ",")
| eval object_value = mvindex(new_field, 0), role = mvindex(new_field, 1) The mvzip function combines two multi-value fields, separating them with a comma. The split function later on breaks the field on the comma. If you have more than two fields to combine, use nested mvzip functions. | eval new_field = mvzip(field1, mvzip(field2, mvzip(field3, field4)))
... View more