Is it possible to use the commands like makemv or nomv in data models? I am using regular expressions while building the datamodel for extracting some of the fields. One of the fields is a comma separated list in the format [a,b,c] or sometimes it is just [d]. I want a single field which will have possible values as a,b,c,d etc. And all this in the data model. Is it possible to achieve this ?
You can do this with a calculated field, using an eval looking something like this:
mvfield = split(trim(commafield, "[]"), ",")
I'm looking for same thing https://answers.splunk.com/answers/368708/how-to-split-a-multivalue-field-for-a-data-modelpi.html