Getting Data In

Making a multivalue field from a value obtained in a lookup

Robbie1194
Communicator

Hi guys,

I'm not sure if this is possible or not but it would be good to get it cleared up so I know for future.

So I'm wondering if I can use props and transforms (and maybe fields.conf) to make a multivalue field at search time. However, the field I want to make multi value isn't indexed, it comes from a lookup that's configured to automatically enrich my data at search time in props.conf. Is this possible? I'm having doubts because I think props/transforms/fields is applied before my automatic lookup?

Any help would be appreciated!

Cheers

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Hello @Robbie1194,

Since lookups are applied after props and transforms, you cant do that.

See this: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

Therefore your only option is to use the SPL commands mvcombine, mvexpand, makemv, nomv, etc. and the eval mv functions as needed.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hello @Robbie1194,

Since lookups are applied after props and transforms, you cant do that.

See this: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Searchtimeoperationssequence

Therefore your only option is to use the SPL commands mvcombine, mvexpand, makemv, nomv, etc. and the eval mv functions as needed.

0 Karma

Robbie1194
Communicator

Yeah i thought as much, was just checking. Thanks.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...