https://community.splunk.com/t5/Splunk-Search/multikv-not-extracting-fields/m-p/96488#M182517 <P>It's always best to answer oneself...</P> <P>The solution is to use the "forceheader=1" flag for multikv.</P> <P>Regards,<BR /> Bartosz</P> Tue, 20 Mar 2012 12:56:49 GMT tzhmaba2 2012-03-20T12:56:49Z https://community.splunk.com/t5/Splunk-Search/multikv-not-extracting-fields/m-p/96487#M182516 <P>Hi,</P> <P>I have created a scripted source which genereates the following output:</P> <PRE><CODE> idx_size_kB idx 24 aaa 24 aaa_sum 2364 appserver 8260716 audit 4 authDb 24 blockSignature 4 bonnie 59894276 defaultdb 324 fishbucket 8 hashDb 356468 hdm 24 hdm_sum 24 historydb 177152 _internaldb </CODE></PRE> <P>As you see it's a simple du -sk on the indexing DB directory of splunk. When I try to do a timechart over one of the values the multikv doesn't generate any field. Also playing with the field picker does not work. Any ideas how can I pick two fields here: "idx_size_kB" and "idx"??</P> <P>index= source=du_idx | multikv - and there are no fields generated. Is it because the values are shifted in eac line??</P> <P>Regards,<BR /> Bartosz</P> Mon, 28 Sep 2020 11:32:26 GMT https://community.splunk.com/t5/Splunk-Search/multikv-not-extracting-fields/m-p/96487#M182516 tzhmaba2 2020-09-28T11:32:26Z https://community.splunk.com/t5/Splunk-Search/multikv-not-extracting-fields/m-p/96488#M182517 <P>It's always best to answer oneself...</P> <P>The solution is to use the "forceheader=1" flag for multikv.</P> <P>Regards,<BR /> Bartosz</P> Tue, 20 Mar 2012 12:56:49 GMT https://community.splunk.com/t5/Splunk-Search/multikv-not-extracting-fields/m-p/96488#M182517 tzhmaba2 2012-03-20T12:56:49Z