https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442862#M168348 <P>I have a event field that comes in as a string that is comma separated. <BR /> field look like <A href="https://google.con,https://Microsoft.com,https://splunk.com">https://google.con,https://Microsoft.com,https://splunk.com</A></P> <P>In my props I have an eval:<BR /> EVAL-urls = split(urls, ",")</P> <P>when searched we only see the <A href="https://google.com">https://google.com</A> is the urls field.</P> <P>How can I make this multivalued ?</P> <P>Thanks!</P> Thu, 12 Jul 2018 14:57:31 GMT pfabrizi 2018-07-12T14:57:31Z https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442862#M168348 <P>I have a event field that comes in as a string that is comma separated. <BR /> field look like <A href="https://google.con,https://Microsoft.com,https://splunk.com">https://google.con,https://Microsoft.com,https://splunk.com</A></P> <P>In my props I have an eval:<BR /> EVAL-urls = split(urls, ",")</P> <P>when searched we only see the <A href="https://google.com">https://google.com</A> is the urls field.</P> <P>How can I make this multivalued ?</P> <P>Thanks!</P> Thu, 12 Jul 2018 14:57:31 GMT https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442862#M168348 pfabrizi 2018-07-12T14:57:31Z https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442863#M168349 <P>Try using the makemv command. This will take a single value field with a delimited list of values and turn it into a multivalued field.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Makemv">http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Makemv</A></P> Thu, 12 Jul 2018 15:05:18 GMT https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442863#M168349 kmorris_splunk 2018-07-12T15:05:18Z https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442864#M168350 <P>can I use a makemv in a props.conf?</P> Thu, 12 Jul 2018 15:18:13 GMT https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442864#M168350 pfabrizi 2018-07-12T15:18:13Z https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442865#M168351 <P>can I use this in a props.conf? <BR /> if so what would the command look like?</P> <P>thanks!</P> Thu, 12 Jul 2018 16:14:52 GMT https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442865#M168351 pfabrizi 2018-07-12T16:14:52Z https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442866#M168352 <P>You can follow this.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/ConfigureSplunktoparsemulti-valuefields">http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/ConfigureSplunktoparsemulti-valuefields</A></P> Thu, 12 Jul 2018 16:19:38 GMT https://community.splunk.com/t5/Splunk-Search/How-make-a-string-field-multivalued/m-p/442866#M168352 somesoni2 2018-07-12T16:19:38Z