Hello Splunk experts, I am encountering strange behaviour when using mvzip on fields extracted using xpath commands. I have provided a toy dataset below that mimics my XML events. I expect mvzip to combine the values in nickname and title pairwise. However, the search below creates only one pair and that too with the "wrong" set of values; the second value from nickname is combined with the first value from title. The other pair is not combined at all.   | makeresults | eval _raw="<foo><bar nickname=\"spock\" title=\"commander\"></bar></foo><foo><bar nickname=\"scotty\" title=\"engineer\"></bar></foo>" | xpath outfield=nickname "//foo/bar/@nickname" field=_raw | xpath outfield=title "//foo/bar/@title" field=_raw | eval zipped=mvzip(nickname, title, "|")   When I use the same syntax on fields extracted via regular expressions, the output is correct. So, I'm suspecting that mvzip doesn't play nice with multivalue fields extracted using xpath. Can anyone confirm if this is a bug or if I'm doing something wrong? I am running Splunk 8.1.3 in case anyone knows if this has been addressed in a later release. ... View more