Mvexpand
Use the mvexpand
function to expand the values in a multivalue field into separate events, one event for each value in the multivalue field.
- Function Input
- collection<record<R>>
- This function takes in collections of records with schema R.
- Function Output
- collection<record<S>>
- This function outputs the same collection of records but with a different schema S.
Arguments
Argument | Input | Description | Example |
---|---|---|---|
field | string | The name of the multivalue field that you want to expand. You can only specify one field to expand. | my_mvexpandfield |
limit | integer | Specifies the number of values to expand in the multivalue field array. If there are any remaining values in the array those values are dropped. If limit = 0 or null, then the limit is treated as the maximum limit. The limit is capped to 1000 for performance concerns. The results of the mvexpand are stored in the field provided. | 10 |
UI example
Suppose your streaming data has fields a, b, and c. Each field has the following corresponding values:
Field a | Field b | Field c |
---|---|---|
1 | x | V1, V2, V3 |
2 | y | V4, V5 |
Pass in the c
field to the mvexpand
function:
Field | Description | Example |
---|---|---|
Field | This is the name of the multivalue field. | c |
Limit | This is the limit you want to set. | 0 |
This example takes each row from the incoming streaming data and then creates a new row with each value in the c field. The other fields will have duplicate values, while the c field will have each value from the multivalue field in a separate row.
Field a | Field b | Field c |
---|---|---|
1 | x | V1 |
1 | x | V2 |
1 | x | V3 |
2 | y | V4 |
2 | y | V5 |
Full DSL example
mvexpand(events, "multivalue_field", 0);
Merge Events | Normalize (projection) |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.1
Feedback submitted, thanks!