Posting an update based on @the_wolverine 's solution provided a few years ago: One weakness of the previous solution is that | mvexpand will generate 20 events for each event it runs against making it difficult to scale. With the addition of | foreach mode=multivalue to Splunk a multivalue list can now be iterated through without generating additional events, improving performance. | makeresults
| eval value=72
| eval power=mvrange(0,20)
| foreach mode=multivalue power [eval item=pow(2,'<<ITEM>>'), base2=mvappend(base2,'item')]
| foreach mode=multivalue base2 [eval value_div=case(value>='<<ITEM>>',floor(value/'<<ITEM>>')%2), bin=mvappend(bin,'value_div')]
| foreach mode=multivalue bin [eval bin_count=mvcount(bin)-1, binary=mvappend(binary,mvindex(bin,-1)), bin=if(mvcount('bin')>=bin_count, mvappend(mvindex(bin,0,bin_count-1),''), bin)]
| nomv binary
| rex mode=sed field=binary "s/\n//g"
| table value power base2 binary
... View more