Multiple Values in Key/Value pair

[ebkeys94]

I am looking to return the multiple values I have on my dashboard currently only one shows up. Here is an example:

Key=1,2,3

On my dashboard only the first value ('1') will show up. How can I get all values to show up and this should work no matter how many values may belong to a certain key.

Thanks!

[yannK]

It may depend how you extracted the field. You may have to redefine an extraction regex, then do the makemv parsing.

example : with an event like Key=1,2,3

  <mysearch > | rex "Key=(?<Key_singlevalue>[\d,]*) "  |  eval Key_multivalue=Key_singlevalue | makemv delim="," Key_multivalue | table Key, Key_singlevalue, Key_multivalue 

Take a look at the multivalues functions
http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Parsemultivaluefields