Hi, thank you again for your response. Generating data from a list that starts with _ seems to be ok, the error occurs after:   | foreach _ip_addresses.*.value [eval keyvalue=mvappend(keyvalue, "<<MATCHSTR>>" . "|" . '<<FIELD>>')] | mvexpand keyvalue     Specifically, it's "mvexpand keyvalue" that generates the error, because apparently "keyvalue" contains no data. When I run this search here:   | makeresults | eval data=mvappend("{ \"ip_addresses\": { \"10.0.0.1\": { \"value\": \"some v4 ip\", \"expire\": 1749267900 }, \"2001:53f1:3:2ee:2252:12e3:228a:112a\": { \"value\": \"some v6 ip\" } } }","{ \"_ip_addresses\": { \"10.0.0.2\": { \"value\": \"some v4 ip\", \"expire\": 1749267900 }, \"2001:53f1:3:2ee:2252:12e3:228a:112b\": { \"value\": \"some v6 ip\" } } }") | mvexpand data | rename data as _raw | spath | foreach _ip_addresses.*.value [eval keyvalue=mvappend(keyvalue, "<<MATCHSTR>>" . "|" . '<<FIELD>>')] | mvexpand keyvalue     I get the error: Thank you! ... View more

Sorry to bother .. a few last questions on this (I hope): For the purposes of having some lists at the top of the list, they have a "_" in front of them. So, if in the example the list was named "_ip_address", it doesn't seem to work. I'm guessing it had something to do with:   | foreach _ip_address.*.value [eval keyvalue=mvappend(keyvalue, "<<MATCHSTR>>" . "|" . '<<FIELD>>')]     I get the error: Field 'keyvalue' does not exist in the data. I get the same error if there are no records in a particular list. I was trying to figure out how to set it if it didn't exist, but wasn't sure where to do that. Thanks again for your help. ... View more

Thank you very much for this!!!  This is exactly what I needed here and based on the solution, I know there's no chance I would have come even close! I don't have to ask questions in here too often because I can usually find a solution in another answer. So grateful for everybody that responds. Thanks @yuanliu ! ... View more

pfft .. nevermind, it does the same thing - this is driving me crazy. I cannot restrict the search to certain elements of a field after a split. ... View more

I have a field that has: value1,value2,value3. I was using split: split_value=split(field, ",") Afterwards, however, I was not able to search on just one of the items. My search string: | eval values=split(field, ",") | search values=foo** This search would show all of the results of values, instead of just foo. Using the makemv delim method, it works. Weird ... ... View more

Awesome, thanks! ... View more

I'm using SVU 2.4.8 and I'm seeing behavior. Interesting, it displays "NaNd ago" when I deploy the dashboard to the search head pool but displays properly when I have it on our dev search head - both have the same versions of everything. I have other dashboards in this search head pool that, while using the same modules, are displaying the time ago just fine. All files are literally rsync'd and nothing is modified, so this business with the line breaks is a bit much for me to believe. Is there any other explanation for it? ... View more

If this isn't working for you .. it's ok, you're not crazy. Chances are you have "or" instead of "OR". Make sure it's capitalized. ... View more

It would be great if the IFX sample data that's shown could be based off the current search. ... View more

I'm not sure why this isn't working for me, I'm assuming it's because the search query provided above isn't meant to be used verbatim. I'm just not sure what to replace with what. This is the error I'm getting: Error in 'eventstats' command: You must specify a rename for the aggregation specifier on the dynamically evaluated field 'sum(eval(count*count))'. Linear I have a field called 'action' and I'm trying to trend a certain action to see where it will be in the next month. ... View more