SPLK-1004 Working with Multivalued Fields

Working with Multivalued Fields Detailed Explanation

1. What is a Multivalued Field?

In Splunk, a multivalued field is a field that contains more than one value in a single event.

Instead of:

email = [email protected]

You might have:

email = [email protected]; [email protected]; [email protected]

Splunk can treat this as a single string or, using multivalue functions, split it into separate values.

Multivalued fields are displayed with values separated by spaces or semicolon/commas, depending on their format.

2. Key Commands for Multivalue Field Handling

Splunk provides several specialized commands to handle multivalued fields. These allow you to split, count, filter, and expand values as needed.

a) makemv

The makemv command converts a delimited string into a multivalue field.

Syntax:

eval <new_field> = makemv(delim="<separator>", <original_field>)

Example:

eval email_list = makemv(delim=";", email)

This transforms:

email = [email protected];[email protected];[email protected]

Into a true multivalued field:

email_list = [[email protected], [email protected], [email protected]]

b) mvexpand

mvexpand takes a multivalue field and creates one event per value.

Example:

... | mvexpand email_list

If one event had three email addresses, Splunk will now produce three events, each with one email from that list. This is helpful when:

• You want to treat each value as an individual record

• You need to join/enrich each value separately

c) mvcount, mvindex, mvfilter

These functions are used to inspect and manipulate multivalued fields.

Function	Purpose	Example
mvcount()	Returns the number of values in a field	mvcount(user_list)
mvindex()	Retrieves a specific value by index (0-based)	mvindex(user_list, 1) → second value
mvfilter()	Filters values based on a condition	mvfilter(match(email, ".*@gmail.com"))

3. Practical Examples

Let’s look at common use cases and how to apply multivalue functions effectively.

a) Extract the Second Value from a List

If you want to retrieve the second user from a multivalued field user_list:

eval second_user = mvindex(user_list, 1)

This is useful when:

• You expect a fixed number of users

• You want to extract a specific role (e.g., second role in a list)

b) Filter Events Where There Are Multiple Values

To find events where the user_list field has more than one user:

where mvcount(user_list) > 1

This helps identify shared access, group activity, or bulk operations.

c) Split a Delimited String and Expand Rows

eval recipients = makemv(delim=",", to_field)
| mvexpand recipients

This:

• Converts a comma-separated to_field into a multivalue list

• Creates one event per recipient

Useful when analyzing email logs, alert notifications, or batch processes.

Summary Table: Multivalue Handling Commands

Command / Function	Purpose
makemv	Split a delimited string into a multivalue field
mvexpand	Breaks a multivalue field into multiple events
mvcount()	Returns number of values in a multivalue field
mvindex()	Returns value at a specific index in a multivalue field
mvfilter()	Filters multivalue entries by condition

Use Case Scenarios

Scenario	Recommended Command
Splitting tags in logs	makemv
Analyzing one tag per row	mvexpand
Checking how many users accessed a resource	mvcount(user_list)
Extracting the first or last IP from a list	mvindex(ip_list, 0)
Filtering emails by domain	mvfilter(match(email, ".*@company.com"))

Working with Multivalued Fields (Additional Content)

1. split() vs makemv() – What’s the Difference?

Both split() and makemv are used to create multivalued fields, but they operate differently and often confuse beginners.

split()

• A function used inside eval.

• Converts a string into a list (multivalue field) based on a delimiter.

| eval user_list=split(users, ",")

Result:
A multivalue field user_list containing values from the comma-separated string.

makemv

• A command, not a function.

• Operates on existing fields (typically _raw or structured fields).

• Can also use custom delimiters.

| makemv delim=";" user_field

Key Differences:

Aspect	split()	makemv
Type	Function (used in eval)	Command
Input	A string	A field
Output	Multivalue list	Multivalue field
Use case	When transforming a string inline	When splitting existing field values

2. mvcombine – Combine Values into a Multivalued Field

The mvcombine command does the opposite of what mvexpand does. It groups rows by a field and combines values from another field into a multivalue list.

Example:

... | stats count by user, role
| mvcombine role by user

Effect:
You collapse multiple rows per user (each with a unique role) into a single row per user, with role as a multivalued field.

Use case:
Useful when you want to aggregate multiple roles, tags, or permissions associated with a single entity.

3. Using Multivalued Fields with stats

When using aggregation commands like stats, multivalued fields can be created using functions like values() or list().

Example:

... | stats values(tag) as tag_list by event_id

• values(tag) aggregates unique values of the field tag per event_id.

• The result tag_list becomes a multivalue field.

This allows further operations such as:

| eval first_tag=mvindex(tag_list, 0)

or

| where mvcount(tag_list) > 3

Summary of Extended Tools for Multivalue Field Handling

Tool	Type	Purpose
split()	Function	Convert a delimited string into a multivalue list
makemv	Command	Split field into multiple values using a delimiter
mvcombine	Command	Merge multiple rows into one with multivalue field
stats values()	Command	Create multivalue fields per group
mvindex()	Function	Access specific value from a multivalue field
mvcount()	Function	Count number of values in a multivalue field