Unable to search mv

[daniel333]

All,

I am unable to search by a mvexpand which I am doing via fields.conf. I am getting the extraction I expect, but searching by that fails.

This search fails, but is based on clicking right in the GUI -
index=main PCIDSS="11.1.2.a"

Reference back to the original post -
https://answers.splunk.com/answers/440752/how-do-i-automatically-run-mvexpand-on-a-field.html

[woodcock]

You are probably running in to this well-known problem:

http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):

[MyField]
INDEXED_VALUE = false

[sundareshr]

What do you get when you do. Do you see PCIDSS as multi-value field?

index=main | table PCIDSS

You could also try

index=main PCIDSS="*11.1.2.a*"

[daniel333]

Searching with the wildcard works great. Table how ever, is not expanded.

11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b

[sundareshr]

You have to use the mvexpand command to expand the table. You can either do

index=main | mvexpand PCIDSS | search PC.... OR index=main PCIDSS="*11.1.2.a*" | mvexpand