Multiple Values in Key/Value pair

ebkeys94 — Tue, 24 Jul 2018 20:58:47 GMT

I am looking to return the multiple values I have on my dashboard currently only one shows up. Here is an example:

Key=1,2,3

On my dashboard only the first value ('1') will show up. How can I get all values to show up and this should work no matter how many values may belong to a certain key.

Thanks!

Re: Multiple Values in Key/Value pair

yannK — Tue, 24 Jul 2018 23:02:02 GMT

It may depend how you extracted the field. You may have to redefine an extraction regex, then do the makemv parsing.

example : with an event like Key=1,2,3

  <mysearch > | rex "Key=(?<Key_singlevalue>[\d,]*) "  |  eval Key_multivalue=Key_singlevalue | makemv delim="," Key_multivalue | table Key, Key_singlevalue, Key_multivalue

Take a look at the multivalues functions
http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Parsemultivaluefields

topic Multiple Values in Key/Value pair in Getting Data In

Multiple Values in Key/Value pair

Re: Multiple Values in Key/Value pair