mvexpand
Description
Expands the values of a multivalue field into separate events, creating one event for each value in the multivalue field.
Syntax
mvexpand <field> [limit=<int>]
Mandatory Arguments
| Parameter | Syntax | Description |
|---|---|---|
field | <field> | The field for which the values are expanded into separate events. |
Optional Arguments
| Parameter | Syntax | Default | Description |
|---|---|---|---|
limit | limit=<int> | Not limited. | The number of the first specified field values to be expanded. |
Query Examples
Example 1
Creating new events for each value of the multivalue field apple.
... | mvexpand apple
Example 2
Creating new events for the first 57 values of the multivalue field apple.
... | mvexpand apple limit=57