...tats values(host) as src_host dc(host) as count by source, index | sort + count
| mvexpand src_host
| outputlookup sourcescheck
Long story short, i got the error:
warn : command.mvexpand: o...
...sing spath and mvexpand i am getting 2/4 for all ab_score and all a_id. not understanding whats happening. Ideally in the raw data 2/4 is there in only 4 places with 4 ab_score attached to it. B...
...ember_dn field. It them puts it into a lookup table to use in ES. Mvexpand is running into limitations with memory and I cannot adjust it high enough to extract all of the values. |l...
... For example, match(text, mytext) where mytext = "abc", and compare now() > strptime(date, "%Y-%m-%d"). I saw many mvexpand solutions in the past, and some mvjoin() solution. mvexpand...
There are a couple of issues which often come up with the limits of mvexpand, one of these is the memory limit, the other is that it only applies to one field. I have developed a set of macros w...
Hi, am I doing this correct or is there another way to tabulate this JSON? I've seen many examples on the forums of people using mvexpand and mvzip to tabulate their JSON but this is working with j...
...laying with this and have worked out that this returns the entire transaction rather than the time for each step in the transaction. I think the mvexpand statement is failing and so the delta s...
There are already several Splunk Answers around mvexpand multiple multi-value fields.
https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html
https://answers.splunk...
...ramed-IPv6-Address=<IPv6 value>, Framed-IPv6-Address=<IPv6 value>, etc
When I try mvexpand index=cisco sourcetype="cisco:ise:syslog" | mvexpand Framed_IPv6_Address I am getting s...