Hi Team, Is there a direct way to retrieve a list of usernames or accounts configured in Splunk Add-ons (such as those used in modular inputs, scripted inputs, or API connections) using Splunk SPL? Regards, VK ... View more

Hi Team, I have a multivalue field in one of the user fields, along with other fields. However, when exporting the data to an external lookup, the multivalue field is converted into a single value, comma-separated value. For example, in my search, the userid field appears as follows: userid 890000 pklstu 790000 c_pklstu However, after exporting to the external lookup, it transforms into: userid 890000,pklstu,790000,c_pklstu I need the multivalue field to remain unchanged in the external lookup so that I can accurately compare user IDs with other lookups. I have tried using mvexpand before exporting, but it introduced other challenges. Is there a way to ensure the multivalue field remains intact while exporting to the external lookup?"   ... View more