Splunk Search

Splunk search - is it possible to automatically expand a result property wrap?

gunnist
Explorer

Hi,
In my query:


index="my_local" | sort -Date

I get a list of items, and if I look at one item (and lick "show as raw text") it looks like this:

{"Level":"Info","MessageTemplate":"ApiRequest","RenderedMessage":"ApiRequest","Properties":{"httpMethod":"GET","statusCode":200}, ...}

Since a lot of the properties are wrapped inside "Properties", I always have to expand it manually by clicking the expand icon (with plus sign).

Is there any way to get the search results already expanded (so I don't always have to click "Properties" to manually expand it)?

Many thanks! :slightly_smiling_face:

0 Karma
1 Solution

codebuilder
Influencer

You can use mvexpand.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Mvexpand

----
An upvote would be appreciated and Accept Solution if it helps!

View solution in original post

0 Karma

codebuilder
Influencer

You can use mvexpand.

https://docs.splunk.com/Documentation/Splunk/8.2.2/SearchReference/Mvexpand

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma

gunnist
Explorer

source=my_local| sort -Date | mvexpand Properties

gives me:

Field 'Properties' does not exist in the data.

 

Am I missing something?

 

0 Karma

codebuilder
Influencer

Does that field exist? And is it a multi-value field?

To verify try something like: source=my_local | table +

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...