Hi,
In my query:
index="my_local" | sort -Date
I get a list of items, and if I look at one item (and lick "show as raw text") it looks like this:
{"Level":"Info","MessageTemplate":"ApiRequest","RenderedMessage":"ApiRequest","Properties":{"httpMethod":"GET","statusCode":200}, ...}
Since a lot of the properties are wrapped inside "Properties", I always have to expand it manually by clicking the expand icon (with plus sign).
Is there any way to get the search results already expanded (so I don't always have to click "Properties" to manually expand it)?
Many thanks! 🙂
You can use mvexpand.
https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Mvexpand
You can use mvexpand.
https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Mvexpand
source=my_local| sort -Date | mvexpand Properties
gives me:
Field 'Properties' does not exist in the data.
Am I missing something?
Does that field exist? And is it a multi-value field?
To verify try something like: source=my_local | table +