Getting Data In

how to use mvexpand in props.conf

monawwer
Loves-to-Learn

I am trying to put mvexpand in props.conf but i am not getting how to do .Is there any alternative ?

0 Karma

jnudell_2
Builder

Hi @monawwer ,
You cannot use mvexpand in props.conf. The mvexpand command is a transforming search command, and props.conf is only used for field extractions for search-time operations.
The only search-time operations you can enter in props.conf are: eval, extract, fieldalias, report, kv_mode and lookup.

0 Karma

monawwer
Loves-to-Learn

As i want to expand multivalue field at index time, Is there any other way ?

0 Karma

mdorobek
Path Finder

What are you trying to achieve? Do you extract a multivalue field and want to expand it on indextime?

Can you name an example?

0 Karma

monawwer
Loves-to-Learn

Yes, I want to expand multivalue field on index time. For example:

Object Color
car black

red

Red is in color field.

Output should be :

Object Colour
car black

car red

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...