mvzip your fields together (presuming they're "correctly aligned now"), mvexpand, and then rex them back apart:
<search> | eval zipped=mvzip(cve,Risk," | ") | mvexpand zipped | rex field=zipped "(?<cve>[^\s]+) | (?<risk>.+)" June 30, 2020 at 10:06AM
via reddit https://www.reddit.com/r/Splunk/comments/hi9t76/question_can_i_use_mvexpand_on_multiple_fields_to/fwh5dif?utm_source=ifttt