https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622070#M107101 <P>anyone ?</P> Fri, 25 Nov 2022 09:45:02 GMT super_saiyan 2022-11-25T09:45:02Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621644#M107053 <P>Hi everyone,<BR /><BR />currently, i am trying to expand one of the multiple field values but i am getting the result with the below error.<BR /><STRONG>Field 'deployment' does not exist in the data.</STRONG><BR /><BR />index=json<BR />|rex mode=sed "s/.*-\s//g"<BR />|spath<BR />|rename ops{}.steps{}.steps{}.address{}.deployment as deployment&nbsp;<BR />|mvexpand deployment<BR />|mvexpand operation<BR />|table deployment</P> Tue, 22 Nov 2022 14:33:48 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621644#M107053 super_saiyan 2022-11-22T14:33:48Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621645#M107054 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244498">@super_saiyan</a>&nbsp;</P><P>Can you please share some sample events?</P><P>Meanwhile, you can try this rename as well.&nbsp;</P><LI-CODE lang="markup">| rename "ops.steps.steps.address.deployment" as deployment</LI-CODE><P>&nbsp;</P><P>KV</P> Tue, 22 Nov 2022 06:22:10 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621645#M107054 kamlesh_vaghela 2022-11-22T06:22:10Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621646#M107055 <P>Thanks much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/127939">@kamlesh_vaghela</a>&nbsp;<BR />I have shared the logs in DM, please check</P> Tue, 22 Nov 2022 06:53:43 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/621646#M107055 super_saiyan 2022-11-22T06:53:43Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622070#M107101 <P>anyone ?</P> Fri, 25 Nov 2022 09:45:02 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622070#M107101 super_saiyan 2022-11-25T09:45:02Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622072#M107102 <P>If you don't have the deployment field, what fields do you have?</P> Fri, 25 Nov 2022 09:49:17 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622072#M107102 ITWhisperer 2022-11-25T09:49:17Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622080#M107103 <P>Hi, I have shared the logs with you in DM</P> Fri, 25 Nov 2022 10:19:05 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622080#M107103 super_saiyan 2022-11-25T10:19:05Z https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622089#M107105 <P>Put the field name in double quotes (usually it is single quotes for field names but rename seems to operate differently)</P><LI-CODE lang="markup">|rename "ops{}.steps{}.steps{}.address{}.deployment" as deployment </LI-CODE> Fri, 25 Nov 2022 12:14:37 GMT https://community.splunk.com/t5/Getting-Data-In/Receiving-an-error-while-using-the-mvexpand-command-does-not/m-p/622089#M107105 ITWhisperer 2022-11-25T12:14:37Z