How make a string field multivalued?

[pfabrizi]

I have a event field that comes in as a string that is comma separated.
field look like https://google.con,https://Microsoft.com,https://splunk.com

In my props I have an eval:
EVAL-urls = split(urls, ",")

when searched we only see the https://google.com is the urls field.

How can I make this multivalued ?

Thanks!

[somesoni2]

You can follow this.

http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/ConfigureSplunktoparsemulti-valuefields

[pfabrizi]

can I use a makemv in a props.conf?

[kmorris_splunk]

Try using the makemv command. This will take a single value field with a delimited list of values and turn it into a multivalued field.

http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Makemv

[pfabrizi]

can I use this in a props.conf?
if so what would the command look like?

thanks!