Getting Data In

mvexpand & split command not working on JSON data

ashish9433
Communicator

Hi,

I have JSON data, which seems to be properly prased. I have a field which holds multiple IPs in a new lined when seen in formatted events and seperated with \n when seen in un-formatted.

Check the below screenshot

alt text

I am unable to use mvexpand or split or even i tried to use makemv command but it doesn't work as expected.

Any clue, how to handle this situation, when i do a stats or table i want IPs as multivalued whereas currently it is displayed as just a text with IPs separated with space.

0 Karma

vsingla1
Communicator

@ashish9433 I am also facing the same issue where splunk is unable to run split and mvexpand on the json data. Did you find a resolution to your question? If so, could you share it?

0 Karma

to4kawa
Ultra Champion

@visngla1
What is your log?
If not, ask another question.

0 Karma

adonio
Ultra Champion

maybe something like this:

... | rex "\"ips\"\:\"(?<all_ips>[^\"]+)"
this will capture all ips as a long string and assign it as a value to the field: "all_ips">
now go to the makemv and mvexpand
... | makemv all_ips delim = "\n" | mvexpand all_ips

hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...