Splunk® Cloud Services

SPL2 Search Reference

mvexpand command examples

The following are examples for using the SPL2 mvexpand command. To learn more about the mvexpand command, see How the SPL2 mvexpand command works.

1. Expand the values in a specific field

Suppose you have the fields a, b, and c. Each field has the following corresponding values:

a b c
1 x V1, V2, V3
2 y V4, V5

You run the mvexpand command and specify the c field.

... | mvexpand c

This example takes each row from the incoming search results and then create a new row with for each value in the c field.The other fields will have duplicate values, while the c field will have each value from the multivalue field in a separate row.

a b c
1 x V1
1 x V2
1 x V3
2 y V4
2 y V5

2. Limit the number of values from the multivalue field to expand

Limit the number of values to expand to 10. Any remaining values are dropped.

... | mvexpand limit=10 my_mvfield

See also

mvexpand command
mvexpand command overview
mvexpand command syntax details
mvexpand command usage
Last modified on 31 January, 2024
mvexpand command usage   rename command overview

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters