This is great, I had no idea you could swap <<ITEM>> and reversed_list in a mvappend(). Thanks for sharing! ... View more

Posting the solution I have for Splunk 9.0+ using | foreach mode=multivalue. A lot of the solutions I saw sorted lexicographically but didn't reverse the order of a multivalue list OP specified.    | makeresults | eval mv_string = "banana,apple,orange,peach", original_list= "banana,apple,orange,peach" | makemv delim="," mv_string | makemv delim="," original_list | foreach mode=multivalue mv_string [eval mv_count=mvcount(mv_string)-1, reversed_list=mvappend(reversed_list,mvindex(mv_string,-1)), mv_string=if(mvcount('mv_string')>=mv_count, mvappend(mvindex(mv_string,0,mv_count-1),''), mv_string)] | table original_list reversed_list   ... View more

Posting an update based on @the_wolverine 's solution provided a few years ago: One weakness of the previous solution is that | mvexpand will generate 20 events for each event it runs against making it difficult to scale. With the addition of | foreach mode=multivalue to Splunk a multivalue list can now be iterated through without generating additional events, improving performance.  | makeresults | eval value=72 | eval power=mvrange(0,20) | foreach mode=multivalue power [eval item=pow(2,'<<ITEM>>'), base2=mvappend(base2,'item')] | foreach mode=multivalue base2 [eval value_div=case(value>='<<ITEM>>',floor(value/'<<ITEM>>')%2), bin=mvappend(bin,'value_div')] | foreach mode=multivalue bin [eval bin_count=mvcount(bin)-1, binary=mvappend(binary,mvindex(bin,-1)), bin=if(mvcount('bin')>=bin_count, mvappend(mvindex(bin,0,bin_count-1),''), bin)] | nomv binary | rex mode=sed field=binary "s/\n//g" | table value power base2 binary   ... View more