mvexpand
Description
Expands the values of a multivalue field into separate events, creating one event for each value in the multivalue field.
Syntax
mvexpand <field> [limit=<int>]
Mandatory Arguments
Parameter | Syntax | Description |
---|---|---|
field | <field> | The field for which the values are expanded into separate events. |
Optional Arguments
Parameter | Syntax | Default | Description |
---|---|---|---|
limit | limit=<int> | Not limited. | The number of the first specified field values to be expanded. |
Query Examples
Example 1
Creating new events for each value of the multivalue field apple
.
... | mvexpand apple
Example 2
Creating new events for the first 57
values of the multivalue field apple
.
... | mvexpand apple limit=57