topic Re: How can I mvexpand field of the events from summary index? in Knowledge Management

How can I mvexpand field of the events from summary index?

tac24 — Tue, 29 Sep 2020 17:41:23 GMT

Before adding results into summary index, I can mvexpand a multi-value field as expected; for checking mvexpand search example,

...  |table reason a |stats values(a) as a_list by reason |table reason a_list |collect index=test_index | mvexpand a_list |table  reason a_list | ...

By stats, a_list has multi-value. The first table reason a and the last table reason a_list, though the field names are different (a va a_list), as a whole, the number of results and values are the same as expected.

But, when I tried to mvexpand to the results in the summary index,

index=test_index | table reason a_list |mvexpand a_list

there is no error message, but it can not expand multi-value field.

Questions: Is there any restrictions for mvexpand to be used for events in summary index?
How can I work around this problem?

Thanks.

Re: How can I mvexpand field of the events from summary index?

493669 — Fri, 19 Jan 2018 05:28:54 GMT

Hi @tac24,
You can try below:

 ...  |table reason a |stats values(a) as a_list by reason| mvexpand a_list |table reason a_list |collect index=test_index  |table  reason a_list | ...

Let me know if it works.

Re: How can I mvexpand field of the events from summary index?

mayurr98 — Fri, 19 Jan 2018 08:03:20 GMT

hey you can try something like this

 ...  |stats values(a) as a_list by reason |mvexpand a_list |collect index=test_index

and then try

 index=test_index

I have re-arranged your query by adjusting and removing unnecessary commands!

let me know if this helps!