Are you a member of the Splunk Community?
- Find Answers
- :
- Apps & Add-ons
- :
- Splunk Development
- :
- Splunk Dev
- :
- extract a multiline field value into multiple even...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a query which gives GroupName and its members in the below format
GroupName member
Domain Admins CN=firstname1\, lastname1 P0,OU=P0-Accounts,OU=test OU
CN=firstname2\, lastname2 P1,OU=P1-Accounts,OU=test OU
CN=firstname3\, lastname3 P3,OU=P3-Accounts,OU=test OU
And im trying to extract it in multiple events like below seperately for each and every member
GroupName member
Domain Admins CN=firstname1\, lastname1 P0,OU=P0-Accounts,OU=test OU
Domain Admins CN=firstname2\, lastname2 P1,OU=P1-Accounts,OU=test OU
Domain Admins CN=firstname3\, lastname3 P3,OU=P3-Accounts,OU=test OU
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does mvexpand work for you?
"your search"
|mvexpand member
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does mvexpand work for you?
"your search"
|mvexpand member
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@renjith_nair No mvexpand didnt work
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok , so why didn't work, is it not a multi value field? or can you share the search which results in the existing state?
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey thanks now I realised my mistake i have used mvexpand on my lookup so it didnt work and now I tried mvexpand on actual index and sourcetype its working fine
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Splunk App Dev Community Updates – What’s New and What’s Next
The Latest Cisco Integrations With Splunk Platform!
