There are already several Splunk Answers around mvexpand multiple multi-value fields. https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html https://answers.splunk.com/answers/123887/how-to-expand-multiple-multivalue-fields.html Some of them also helped in improving Splunk Docs (Example 3) https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Mvexpand#Examples Now, how can it auto-scale horizontally for any number of fields? Here is a macro based solution for this question. Macro Name: my_mvexpand(2) Usage: my_mvexpand(2) macro takes two arguments. First argument is one of the multi-value field, which you would like to expand. Second argument takes the list of other multi-value fields (comma OR space separated), which you would like to zip & expand along with mvfield in the First argument. ### Syntax: `my_mvexpand("mv_field_1","mv_field_2,mv_field_3")` //comma separated second argument `my_mvexpand("mv_field_1","mv_field_2 mv_field_3 mv_field_4")` //space separated second argument ### Example 1: | makeresults | eval f1=split("a1,a2,a3",",") | eval f2=split("b1,b2,b3",",") | eval f3=split("c1,c2,c3",",") `my_mvexpand(f1,"f2 f3")` ### Example 2: | makeresults | eval x="another_single_value_field" | eval f1=split("a1,a2,a3",",") | eval f2=split("b1,b2,b3",",") | eval f3=split("c1,c2,c3",",") | eval f4=split("d1,d2,d3",",") `my_mvexpand("f1","f2,f3,f4")` Please note, similar to other solutions already answered in Splunk Answers, this macro based solution works only with mvfields of same cardinality (i.e. mvfields having same mvcount) Feel free to use and enhance 🙂 ... View more