Greetings. Suppose I have an event schema of just a URL, where the query section of the URL may change: ```ndjson { url: "/?a=b&c=d" } { url: "/?arbitraryKey=arbitraryValue" } ``` The KV pairs are arbitrary. From sibling thread, I have already extracted KEYS, VALUES from params into multi-value fields. For example: ``` // pseudo-code of Splunk variables, first event keys = MultiValue [ a, c ] values = MultiValue [ b, d ] // pseudo-code of Splunk variables, second event keys = MultiValue [ arbitraryKey ] values = MultiValue [ arbitraryValue ] ``` I want each KV pair added to the associated event, such that, at the end of my query, I can do interesting states. For example, i may want to `| table a, c, arbitraryKey` and see two records, corresponding to the input events above: ```txt a, c, arbitraryKey -------- b, d, null null, null, arbitraryValue ``` Simply put, I want to derive a suite of KV pairs from an event, then merge them back into the event. `mvexpand` creates new rows, so that's not what I want. What other options do I have?
... View more