The outer mvappend function contains three values: the inner mvappend function, destip is a field name, and 192.168.1.1 which is a literal IP address.

The inner mvappend function contains two values: localhost is a literal string value and srcip is a field name.

The following example shows how to use nested mvappend functions. | eval fullName=mvappend('localhost', srcip) This example shows how to append two values, localhost is a literal string value and srcip is a field name. The arguments can be strings, multivalue fields or single value fields. This function takes one or more arguments and returns a single multivalue result that contains all of the values. | eval x=commands('search foo | stats count | sort count') mvappend() Description The following example returns a multivalued field called x, that contains the commands search, stats, and sort which are the commands used in the search string specified. You can use this function with the eval, fieldformat, and where commands, and as part of eval expressions. This function is generally not recommended for use except for analysis of audit.log events. This function takes a search string, or field that contains a search string, and returns a multivalued field containing a list of the commands used in. See Statistical eval functions.įor information about using string and numeric fields in functions, and nesting functions, see Evaluation functions.

You can also use the statistical eval functions, max and min, on multivalue fields. The following list contains the functions that you can use on multivalue fields or to return multivalue fields. ™ ® Enterprise ® Universal Forwarder ® Data Stream Processor ® Cloud Services ® Attack Analyzer ® App for Splunk Attack Analyzer ® Add-on for Splunk Attack Analyzer ® Enterprise Security ® Mission Control ® SOAR (Cloud) ® SOAR (On-premises) ® User Behavior Analytics ® App for Fraud Analytics ® Security Essentials ® Security Content ® Security for SAP ® solutions ® Security Add-on for SAP ® solutions ® Security App for SAP ® solutions ® User Behavior Analytics Monitoring App ® User Behavior Analytics Kafka Ingestion App ® IT Service Intelligence ® IT Essentials Work ® IT Essentials Learn ® App for Content Packs ® ITSI Module for Application Performance Monitoring ® ITSI Event Management SDK ® Content Packs for ITSI and IT Essentials Work ® Service Intelligence for SAP ® Solutions ® Infrastructure Monitoring Add-on ® ITSI Module for Continuous Delivery ® Supported Add-ons ® Add-on for OpenTelemetry Collector ® Add-on Builder ® Firehose Nozzle for VMware Tanzu ® Connect for Kafka ® Connect for Zoom ® Connected Experiences ® Secure Gateway ® Private Spacebridge ® Edge Hub mobile app ® Edge Hub OS ® Mobile for iOS ® Mobile for Android ® TV for Apple TV (EOL) ® App for TV (EOL) ® TV Companion (EOL) ® for iPad (EOL) ® AR for iOS ® AR for Android ® App for Edge Hub and Augmented Reality ® TV for Android and Fire TV (EOL) ® Cloud Gateway (Legacy) ® Machine Learning Toolkit ® App for Data Science and Deep Learning ® App for Anomaly Detection ® AI Assistant ® Common Information Model Add-on ® Dashboards App ® InfoSec App ® App for Lookup File Editing ® App for SOAR ® App for SOAR Export ® Platform Upgrade Readiness App ® DB Connect ® ODBC Driver ™ ® Datasets Add-on ® App for AWS Security Dashboards ® VMware OVA for ITSI ® Add-on for Infrastructure ® App for PCI Compliance ® Add-on for Splunk UBA ® Add-on for Windows ® Add-on for Microsoft Exchange Indexes ® OVA for VMware and NetApp ® OVA for VMware Metrics ® Supporting Add-on for VMware ® Supporting Add-on for NetApp ® Supporting Add-on for Active Directory ® Phantom App for Splunk ® Automation Broker ® Phantom Remote Search ® Add-on for Splunk Phantom ® App for Chargeback ® SDKs ® SDK for Python Reference ® SDK for Java Reference ® SDK for JavaScript Reference ® logging for JavaScript ® logging for Java ® Web Framework ® Products Version Compatibility ® Validated Architectures ® Community ® Answers ® Style Guide ® Phantom (Legacy) ® Intelligence Management (Legacy) ®(Legacy) ® SDK for PHP Reference (deprecated) ® SDK for Ruby Reference (deprecated) ® Add-on for Microsoft Active Directory (Legacy) ® Add-on for Microsoft Windows DNS (Legacy) ® Add-on for Unix and Linux (Legacy) ® App for Windows Infrastructure (Legacy) ® App for NetApp Data ONTAP (Legacy) ® App for Unix and Linux (Legacy) ® Business Flow (Legacy) ® Deployment Monitor App (Legacy) ® Industrial Asset Intelligence (Legacy) ® for Industrial IoT (Legacy) ® ITSI Module for Cloud Services (deprecated) ® Metrics Workspace (Legacy) ™ (Legacy) ™ Management Console (Legacy) ™ App (Legacy) ™ Add-on (Legacy) ™ SDK for Android (Legacy) ™ SDK for iOS (Legacy) ™ REST API (Legacy) ® Mobile Access Server (Legacy) ® App for VMware (Legacy) ® App for AWS (Legacy) ® App for Infrastructure (Legacy) ® App for Microsoft Exchange (EOL)

Splunk rex delimiter