Really late to the party but this still shows in Google search results so here you go: | eval mv_combined_field=mvzip(mvfield1,mvfield2,"|")
| mvexpand mv_combined_field
| eval mv_combined_field_expanded=split(mv_combined_field,"|")
| eval mvfield1=mvindex(mv_combined_field_expanded,0), mvfield2=mvindex(mv_combined_field_expanded,1) The delimiter "|" was chosen assuming your data does not contain pipes. It is just to separate the events for later extraction. So with mvzip we take first value of mvfield1 and mvfield2 and combine them together (separated by "|"), same with second with second and so on. Now we've created a single mv field.Now expand with mvexpand and split the values, taking first value with mvindex and second value with mvindex. For more than 2 fields you can nest it (unlimited times): | eval mv_combined_field=mvzip(mvfield1,mvzip(mvfield2,mvfield3,"|"),"|")
| mvexpand mv_combined_field
| eval mv_combined_field_expanded=split(mv_combined_field,"|")
| eval mvfield1=mvindex(mv_combined_field_expanded,0), mvfield2=mvindex(mv_combined_field_expanded,1), mvfield3=mvindex(mv_combined_field_expanded,2) Hope this helps!
... View more