Usage

You can use the mvexpand operator when you want to distinguish individual values in the event having the multivalue field.

Examples

Example 1: Expand tags into separate rows and filter by tag value.

observables | calc tags_array = array_join(tags, ',') | mvexpand tags | where tags_expanded contains_ci 'malware'

Example 2: Expand sourcetype field parsed by space delimiter into separate rows.

|fields sourcetype |makemv delim=" " sourcetype | mvexpand sourcetype_mv

Example 3: Expand IP address field parsed by dot delimiter into separate rows.

|fields event_time, src |makemv delim="." src | mvexpand src_mv

Example 4: Expand source IP address field for specific IP with delimiter parsing.

|where src = "192.168.2.14" |fields event_time, src | makemv delim ="." src | mvexpand src_mv

Example 5: Takes two OCSF events, creates a comma-delimited test field, splits it into a multi-value field, reverses it, expands each value into its own row, converts the multi-value field back to a single value, then returns the expanded and reversed string values

ocsf | limit 2 | calc r.test='1,2' | fields r.test | makemv delim=',' r.test | mvreverse(r.test) | mvexpand r.test_mv | nomv r.test_mv --| return $r.test_mv_mv_str, r.test_reverse