topic Splunk search - is it possible to automatically expand a result property wrap? in Splunk Search

Splunk search - is it possible to automatically expand a result property wrap?

gunnist — Mon, 23 Aug 2021 13:47:02 GMT

Hi,
In my query:

index="my_local" | sort -Date

I get a list of items, and if I look at one item (and lick "show as raw text") it looks like this:

{"Level":"Info","MessageTemplate":"ApiRequest","RenderedMessage":"ApiRequest","Properties":{"httpMethod":"GET","statusCode":200}, ...}

Since a lot of the properties are wrapped inside "Properties", I always have to expand it manually by clicking the expand icon (with plus sign).

Is there any way to get the search results already expanded (so I don't always have to click "Properties" to manually expand it)?

Many thanks! 🙂

Re: Splunk search - is it possible to automatically expand a result property wrap?

codebuilder — Mon, 23 Aug 2021 14:02:16 GMT

You can use mvexpand.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Mvexpand

Re: Splunk search - is it possible to automatically expand a result property wrap?

gunnist — Mon, 23 Aug 2021 16:26:29 GMT

source=my_local| sort -Date | mvexpand Properties

gives me:

Field 'Properties' does not exist in the data.

Am I missing something?

Re: Splunk search - is it possible to automatically expand a result property wrap?

codebuilder — Mon, 23 Aug 2021 17:12:51 GMT

Does that field exist? And is it a multi-value field?

To verify try something like: source=my_local | table +