mvexpand
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
mvexpand
Synopsis
Expands the values of a multi-value field into separate events for each value of the multi-value field.
Syntax
mvexpand <field>
Required arguments
- field
- Syntax: <field>
- Description: The name of a multivalue field.
Description
For each result with the specified field, create a new result for each value of that field in that result if it a multivalue field.
Examples
Example 1: Create new events for each value of multi-value field, "foo".
... | mvexpand fooSee also
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the mvexpand command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.