Hello @ITWhisperer, thank you very much for the quick answer, which helped a lot. We need to do the transformation for multiple fields within a complex query. Therefore, the solution had to be adapted somewhat: | makeresults
| eval fieldname1="1;A__B
2;B__C__D__A__E
3;G"
| eval other_fields_1="other_content"
| eval tmp_raw = _raw
| eval _raw=fieldname1 ``` temporarily overwriting _raw with the field value ```
| multikv noheader=t
| table _raw *other_fields* ``` to keep the fields which we still need ```
| eval first=mvindex(split(_raw,";"),0)
| eval second=split(mvindex(split(_raw,";"),1),"__")
| mvexpand second
| eval _raw=first.";".second
| rename _raw as fieldname1
| fields - first,second
| mvcombine delim="\n" fieldname1 ``` to get a multivalue field ```
| eval _raw = tmp_raw
| table * Is there a better solution than overwriting _raw with the field value? I also was surprised that creating a multikv.conf file seems not to be required, as it autodetects semicolon as the separator and ignores the underlines.
... View more
