I am doing a query, where I get a multi valued field and I need to append something to each value depending what the value is. I can't find a way to apply a statement to the multiple values, the only thing I can think to do is to expand the field make my change and recombine it. However, when I recombine it, the timestamp _time loses its content and this is a field we need.
Yes, it is intended behavior. As a rule, we don't use any _* fields in mvcombine. This is because you may often see events that differ only in internal fields that are not shown (i.e. _cd), and then wonder why they weren't combined.