- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![GersonGarcia GersonGarcia](https://community.splunk.com/legacyfs/online/avatars/253389.jpg)
GersonGarcia
Path Finder
07-25-2022
08:21 AM
Hello,
I am trying to create dashboard input based on lookup table. I have simple lookup with monitor name and list of all components it may apply:
$ cat Itron_INS_monitors.csv
"Monitor_Name",Component
"AMM::DB::Unscheduled Jobs",DB
"APP:::Tibco::ERROR: Accept() failed: too many open files",TIBCO
"App::All::DB Connection Pool Exhausted","FWU
GMR
MPC
MT
NEM
ODS
THIRDPARTY
TMB
RMACA
CAAS
HCM
NEC
DMS
DLCA
*
FPS
SSNAGENT
SSNAGENTFORWARDER
TRAPROUTER
AMMWSROUTE
AMMJMSROUTE
ODSJMSROUTE
HCMWSROUTE
MPCWSROUTE
SENSORIQWSROUTE
ODSWSROUTE
AMMMULTISPEAK
REG
SAM
PM
SENSORIQ
TBR
ACTIVEMONITOR
ZCU"
For some reason, mvexpand does not work.
It is not memory, because my csv file has just ~100 lines.
Please help!!!
Thank you
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![kamlesh_vaghela kamlesh_vaghela](https://community.splunk.com/legacyfs/online/avatars/339361.jpg)
kamlesh_vaghela
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
07-25-2022
08:53 AM
You have to put a new line in the split function
|eval Component=split(Component,"
")
SPL.
| inputlookup Itron_INS_monitors.csv
| table Monitor_Name Component
|eval Component=split(Component,"
")
| mvexpand Component
KV
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
richgalloway
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
07-25-2022
08:32 AM
mvexpand doesn't work because the field is not a multi-value field. It's a single-value field with embedded newlines. Try using the split function to break up the field then mvexpand should work.
... | fields Monitor_Name Component
| eval Component=split(Component, "
")
| mvexpand Component
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![GersonGarcia GersonGarcia](https://community.splunk.com/legacyfs/online/avatars/253389.jpg)
GersonGarcia
Path Finder
07-25-2022
09:01 AM
Yes, that works... Interesting why \n didn't...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![richgalloway richgalloway](https://community.splunk.com/legacyfs/online/avatars/140500.jpg)
richgalloway
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
07-25-2022
09:37 AM
It's because the split function does not accept regular expressions. It expects plain text.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![GersonGarcia GersonGarcia](https://community.splunk.com/legacyfs/online/avatars/253389.jpg)
GersonGarcia
Path Finder
07-25-2022
08:37 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![kamlesh_vaghela kamlesh_vaghela](https://community.splunk.com/legacyfs/online/avatars/339361.jpg)
kamlesh_vaghela
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
07-25-2022
08:53 AM
You have to put a new line in the split function
|eval Component=split(Component,"
")
SPL.
| inputlookup Itron_INS_monitors.csv
| table Monitor_Name Component
|eval Component=split(Component,"
")
| mvexpand Component
KV
![](/skins/images/5D2DD17C284106BFBF80528D01D8AA1A/responsive_peak/images/icon_anonymous_message.png)