Splunk Search

Help with SPL Splunk part 2

uagraw01
Motivator

To provide further from yesterday's SPL query. I am facing huge events in multivalues. I want to break in a single event. How can I achieve it.

My current events are look like as below.

uagraw01_0-1666334392521.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @uagraw01,

let me better understand you need:

you have al these long error messages and you have them in a multivalue,you want to have each of them in a single event, is it correct?

Anyway, the method to transform a multivale in single events is mvexpand command (https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Mvexpand).

If you could share your final search I could be more precise in mvexpand use.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...