Getting Data In

mvexpand & split command not working on JSON data

ashish9433
Communicator

Hi,

I have JSON data, which seems to be properly prased. I have a field which holds multiple IPs in a new lined when seen in formatted events and seperated with \n when seen in un-formatted.

Check the below screenshot

alt text

I am unable to use mvexpand or split or even i tried to use makemv command but it doesn't work as expected.

Any clue, how to handle this situation, when i do a stats or table i want IPs as multivalued whereas currently it is displayed as just a text with IPs separated with space.

0 Karma

vsingla1
Communicator

@ashish9433 I am also facing the same issue where splunk is unable to run split and mvexpand on the json data. Did you find a resolution to your question? If so, could you share it?

0 Karma

to4kawa
Ultra Champion

@visngla1
What is your log?
If not, ask another question.

0 Karma

adonio
Ultra Champion

maybe something like this:

... | rex "\"ips\"\:\"(?<all_ips>[^\"]+)"
this will capture all ips as a long string and assign it as a value to the field: "all_ips">
now go to the makemv and mvexpand
... | makemv all_ips delim = "\n" | mvexpand all_ips

hope it helps

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...

Getting Started with Splunk Artificial Intelligence, Insights for Nonprofits, and ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Observability Cloud’s AI Assistant in Action Series: Identifying Unknown ...

Agentic AI powers the Splunk AI Assistant within the Splunk Observability Cloud interface to help you quickly ...