Getting Data In

Receiving an error while using the mvexpand command (does not exist in the data)

super_saiyan
Communicator

Hi everyone,

currently, i am trying to expand one of the multiple field values but i am getting the result with the below error.
Field 'deployment' does not exist in the data.

index=json
|rex mode=sed "s/.*-\s//g"
|spath
|rename ops{}.steps{}.steps{}.address{}.deployment as deployment 
|mvexpand deployment
|mvexpand operation
|table deployment

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Put the field name in double quotes (usually it is single quotes for field names but rename seems to operate differently)

|rename "ops{}.steps{}.steps{}.address{}.deployment" as deployment 
0 Karma

super_saiyan
Communicator

anyone ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If you don't have the deployment field, what fields do you have?

0 Karma

super_saiyan
Communicator

Hi, I have shared the logs with you in DM

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@super_saiyan 

Can you please share some sample events?

Meanwhile, you can try this rename as well. 

| rename "ops.steps.steps.address.deployment" as deployment

 

KV

0 Karma

super_saiyan
Communicator

Thanks much @kamlesh_vaghela 
I have shared the logs in DM, please check

0 Karma
Get Updates on the Splunk Community!

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...