Yes, multivalue fields are accessible via the Python SDK. Let's use the following working example.
Get a search job that has multivalue fields (I coerce that by using makemv 😞
my_job = splunk.search.dispatch('| windbag | makemv delim=" " sample | fields sample, host, source')
and then grab the first result to play around with:
result = my_job.results[0]
result is actually an object that contains all of the multivalue data as well as tags:
>>> result.fields.keys()
['sample', 'host', 'source', '_cd', '_raw', '_time']
>>> result.fields['sample']
Je,peux,manger,du,verre,,ça,ne,me,fait,pas,de,mal.
>>> result.fields['sample'][0]
<splunk.search.ResultFieldValue object at 0xa7dd8d0>
>>> result.fields['sample'][0].value
'Je'
>>> result.fields['sample'][0].tags
[]
>>> len(result.fields['sample'])
12
>>> result.fields['sample'][11].value
'mal.'
From the example above, you'll note that:
the base ResultField object will return a convenience string that is a concatenation of all of its values
applying an index selector to the ResultField object will pull out each multivalue field individually
the multivalue field values are stored in an array
the individual ResultFieldValue object contains 'value' and 'tags' members
... View more