Knowledge Management

How can I mvexpand field of the events from summary index?

New Member

Before adding results into summary index, I can mvexpand a multi-value field as expected; for checking mvexpand search example,

...  |table reason a |stats values(a) as a_list by reason |table reason a_list |collect index=test_index | mvexpand a_list |table  reason a_list | ...

By stats, a_list has multi-value. The first table reason a and the last table reason a_list, though the field names are different (a va a_list), as a whole, the number of results and values are the same as expected.

But, when I tried to mvexpand to the results in the summary index,

index=test_index | table reason a_list |mvexpand a_list 

there is no error message, but it can not expand multi-value field.

Questions: Is there any restrictions for mvexpand to be used for events in summary index?
How can I work around this problem?


0 Karma

Super Champion

hey you can try something like this

 ...  |stats values(a) as a_list by reason |mvexpand a_list |collect index=test_index 

and then try


I have re-arranged your query by adjusting and removing unnecessary commands!

let me know if this helps!

0 Karma

Super Champion

Hi @tac24,
You can try below:

 ...  |table reason a |stats values(a) as a_list by reason| mvexpand a_list |table reason a_list |collect index=test_index  |table  reason a_list | ...

Let me know if it works.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...