multivalue field

multivalue field


A field that exists in the Splunk platform event data that contains more than one value. Fields usually have a single value, but for events such as email logs you can often find multivalue fields in the To: and Cc: information.

You can use the Search Processing Language (SPL) to modify multivalue fields. You can separate multivalue fields into multiple single value fields, or you can combine single value fields into multivalue fields.

For more information

In the Knowledge Manager Manual:

In the Search Manual: