Splunk® Cloud Services

SPL2 Search Reference

Acrobat logo Download manual as PDF


Acrobat logo Download topic as PDF

mvexpand command examples

The following are examples for using the SPL2 mvexpand command. To learn more about the mvexpand command, see How the mvexpand command works.

1. Expand the values in a specific field

Suppose you have the fields a, b, and c. Each field has the following corresponding values:

a b c
1 x V1, V2, V3
2 y V4, V5


You run the mvexpand command and specify the c field.

... | mvexpand c

This example takes each row from the incoming search results and then create a new row with for each value in the c field.The other fields will have duplicate values, while the c field will have each value from the multivalue field in a separate row.

a b c
1 x V1
1 x V2
1 x V3
2 y V4
2 y V5

2. Limit the number of values from the multivalue field to expand

Limit the number of values to expand to 10. Any remaining values are dropped.

... | mvexpand limit=10 my_mvfield

See also

mvexpand command
mvexpand command overview
mvexpand command syntax details
mvexpand command usage
Last modified on 29 April, 2020
PREVIOUS
mvexpand command usage
  NEXT
rename command overview

This documentation applies to the following versions of Splunk® Cloud Services: current


Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters