The Signal Tower • Room 3

Multivalued Fields

A **multivalued field** contains more than one value in a single event (e.g., a `recipient` field with 3 email addresses).

`mvexpand` explodes each value into its own separate event row.

`mvcount` returns the number of values. `mvindex` extracts a value by position. `makemv` splits a single string into multiple values using a delimiter.

Splitting a Field

| eval emails=split(recipients, ";")

Expanding Rows

| mvexpand emails

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Use makemv to split a field called "tags" on the comma delimiter, then use mvexpand to create one row per tag.

Splunk Search Bar