To create a multivalue field from a single string with comma-separated values, the makemv command is used with the delim parameter to specify the delimiter.
The correct syntax is:
| makemv delim="," product
This command splits the product field into multiple values wherever a comma is found, effectively creating a multivalue field.
References:
makemv - Splunk Documentation

An event handler action can trigger an eval statement based on a user ' s interaction with a form. This makes dashboards interactive by allowing real-time updates based on user input, modifying the data presented dynamically.

A report qualifies for acceleration in Splunk if it involves fewer than 100,000 events in the search results and uses transforming commands. Transforming commands aggregate data, which helps reduce the dataset's size and complexity, making the report suitable for acceleration.

One of the best practices in regex is to avoid backtracking, which can degrade performance by revisiting parts of the input multiple times. Optimizing regex patterns to prevent unnecessary backtracking improves efficiency, especially when dealing with large datasets.