Splunk Mvexpand

Extends the contents of a multivalue field within separate events, an individual event for each value within the multivalue field. During a specific result, the mvexpand command generates a distinct result for each multivalue field.