Getting Data In

how to use mvexpand in props.conf

monawwer
Loves-to-Learn

I am trying to put mvexpand in props.conf but i am not getting how to do .Is there any alternative ?

0 Karma

jnudell_2
Builder

Hi @monawwer ,
You cannot use mvexpand in props.conf. The mvexpand command is a transforming search command, and props.conf is only used for field extractions for search-time operations.
The only search-time operations you can enter in props.conf are: eval, extract, fieldalias, report, kv_mode and lookup.

0 Karma

monawwer
Loves-to-Learn

As i want to expand multivalue field at index time, Is there any other way ?

0 Karma

mdorobek
Path Finder

What are you trying to achieve? Do you extract a multivalue field and want to expand it on indextime?

Can you name an example?

0 Karma

monawwer
Loves-to-Learn

Yes, I want to expand multivalue field on index time. For example:

Object Color
car black

red

Red is in color field.

Output should be :

Object Colour
car black

car red

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...