mvexpand command: Examples

The following are examples for using the SPL2 mvexpand command. To learn more about the mvexpand command, see How the SPL2 mvexpand command works.

1. Expand the values in a specific field

Suppose you have the fields a, b, and c. Each field has the following corresponding values:

a b c
1 x V1, V2, V3
2 y V4, V5

You run the mvexpand command and specify the c field. 

... | mvexpand c

This example takes each row from the incoming search results and then create a new row with for each value in the c field.The other fields will have duplicate values, while the c field will have each value from the multivalue field in a separate row.

a b c
1 x V1
1 x V2
1 x V3
2 y V4
2 y V5

2. Limit the number of values from the multivalue field to expand

Limit the number of values to expand to 10. Any remaining values are dropped. 

... | mvexpand limit=10 my_mvfield

3. Pipeline example

Consider the following raw event data:

_raw
9/13/2024 09:00:00

SERVER myserver

STATUS: OK
Server 1: 192.0.2.1
Server 2: 192.0.2.2
Server 3: 192.0.2.3

To separate the IP addresses from the _raw field, use the mvexpand command. 

$pipeline = from $source 
| rex field=_raw max_match=0 /(?P<iplist>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})/
| mvexpand iplist
| into $destination

The results look like this:

_raw iplist
9/13/2024 09:00:00

SERVER myserver

STATUS: OK
Server 1: 192.0.2.1
Server 2: 192.0.2.2
Server 3: 192.0.2.3

192.0.2.1
9/13/2024 09:00:00

SERVER myserver

STATUS: OK
Server 1: 192.0.2.1
Server 2: 192.0.2.2
Server 3: 192.0.2.3

192.0.2.2
9/13/2024 09:00:00

SERVER myserver

STATUS: OK
Server 1: 192.0.2.1
Server 2: 192.0.2.2
Server 3: 192.0.2.3

192.0.2.3