topic Re: Making a multivalue field from a value obtained in a lookup in Getting Data In

Making a multivalue field from a value obtained in a lookup

Robbie1194 — Wed, 06 Sep 2017 14:31:15 GMT

Hi guys,

I'm not sure if this is possible or not but it would be good to get it cleared up so I know for future.

So I'm wondering if I can use props and transforms (and maybe fields.conf) to make a multivalue field at search time. However, the field I want to make multi value isn't indexed, it comes from a lookup that's configured to automatically enrich my data at search time in props.conf. Is this possible? I'm having doubts because I think props/transforms/fields is applied before my automatic lookup?

Any help would be appreciated!

Cheers

Re: Making a multivalue field from a value obtained in a lookup

jkat54 — Wed, 06 Sep 2017 14:59:45 GMT

Hello @Robbie1194,

Since lookups are applied after props and transforms, you cant do that.

See this: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

Therefore your only option is to use the SPL commands mvcombine, mvexpand, makemv, nomv, etc. and the eval mv functions as needed.

Re: Making a multivalue field from a value obtained in a lookup

Robbie1194 — Wed, 06 Sep 2017 15:05:49 GMT

Yeah i thought as much, was just checking. Thanks.