Getting Data In

Multiple Values in Key/Value pair


I am looking to return the multiple values I have on my dashboard currently only one shows up. Here is an example:


On my dashboard only the first value ('1') will show up. How can I get all values to show up and this should work no matter how many values may belong to a certain key.


0 Karma

Splunk Employee
Splunk Employee

It may depend how you extracted the field. You may have to redefine an extraction regex, then do the makemv parsing.

example : with an event like Key=1,2,3

  <mysearch > | rex "Key=(?<Key_singlevalue>[\d,]*) "  |  eval Key_multivalue=Key_singlevalue | makemv delim="," Key_multivalue | table Key, Key_singlevalue, Key_multivalue 

Take a look at the multivalues functions

0 Karma