Most eval functions balk with multi-value fields. I'm skipping over strptime in these examples, but know that you need a single value field for strptime.
If you just need to work with the first or last values, you can put them into new fields before working with them.
| eval start_date_first=mvindex(start_date, 0)
| eval start_date_last=mvindex(start_date, -1)
| eval end_date_first=mvindex(end_date, 0)
| eval end_date_last=mvindex(end_date, -1)
Another option is to create a separate row for each users start and end date:
| eval periods=mvzip(start_date, end_date) // create multi-value field for with pairs of comma separated dates
| mvexpand periods // separate each pair into separate events
| makemv periods delim="," // separate the pair into a multi-value
| eval start_date=mvindex(periods, 0) // set the first value to start_date
| eval end_date=mvindex(periods, -1) // set the last value to end_date
I've broken this down a little granularly than necessary. Many of these could be combined, but remember you often need to cast mvindex() output into a type with tostring() or tonumber(). For intance:
| eval foo= mvindex(bar, 0) * 2 // always throws error
| eval foo= tonumber(mvindex(bar, 0)) * 2 // works
... View more
