topic Re: How to create a base search that uses values from a multi-value field as indices? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/518461#M145798 <P>If the field is not multivalue then <FONT face="courier new,courier">mvexpand</FONT> will not do anythihg to it.</P> Tue, 08 Sep 2020 14:29:09 GMT richgalloway 2020-09-08T14:29:09Z How to create a base search that uses values from a multi-value field as indices? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/517795#M145621 <P>I have a lookup table. Let's say the lookup table contains a column called "a". The "a" column contains a list of indices.</P><P>How can I perform a stats count of logs found in each index from the "a" column?</P><P>&nbsp;</P><LI-CODE lang="markup">| inputlookup lookuptable.csv | table a</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Thu, 03 Sep 2020 18:50:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/517795#M145621 jsven7 2020-09-03T18:50:34Z Re: How to create a base search that uses values from a multi-value field as indices? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/517824#M145630 <P>If I understand the question, this may help.&nbsp;&nbsp;</P><LI-CODE lang="markup">| inputlookup lookuptable.csv | fields a | mvexpand a | map search="search index=$a$"</LI-CODE> Thu, 03 Sep 2020 21:01:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/517824#M145630 richgalloway 2020-09-03T21:01:00Z Re: How to create a base search that uses values from a multi-value field as indices? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/518459#M145797 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp; - thanks Rich. May I ask, what if&nbsp;<EM><STRONG>some</STRONG></EM><EM>&nbsp;</EM>of the values are multivalued, pipe-deliminated values. How may I make $a$ single-valued?</P> Tue, 08 Sep 2020 14:15:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/518459#M145797 jsven7 2020-09-08T14:15:18Z Re: How to create a base search that uses values from a multi-value field as indices? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/518461#M145798 <P>If the field is not multivalue then <FONT face="courier new,courier">mvexpand</FONT> will not do anythihg to it.</P> Tue, 08 Sep 2020 14:29:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-base-search-that-uses-values-from-a-multi-value/m-p/518461#M145798 richgalloway 2020-09-08T14:29:09Z