Splunk Core and Splunk SOAR both have concepts of multivalue fields but treat them differently. Splunk SOAR expects the multivalue fields to be split out into individual artifacts. It would not be unusual to have 100's of artifacts in a single container, each artifact being relatively small. We also have the artifact labeling system to help differentiate artifacts. My recommendation would be to embrace the option of sending over multivalue fields as individual artifacts. If there is no mechanism to split the multivalue fields before ingestion, then you can use a preprocess playbook to grab the multivalue field using a utility like "list_demux" and split the output, and then create individual artifacts using the "artifact_create" utility. This will make it easier for all future playbooks to grab the artifact values from that container.  You could use "list_demux" to split a mulltivalue field without creating new artifacts, but then you would need to use that utility in every playbook and that would not be ideal. I hope that helps! Let me know if need additional clarification. ... View more