All,
I am unable to search by a mvexpand which I am doing via fields.conf. I am getting the extraction I expect, but searching by that fails.
This search fails, but is based on clicking right in the GUI -
index=main PCIDSS="11.1.2.a"
Reference back to the original post -
https://answers.splunk.com/answers/440752/how-do-i-automatically-run-mvexpand-on-a-field.html
You are probably running in to this well-known problem:
http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/
The solution is to put this into fields.conf in the same directory that you have your field extractions (where props.conf is):
[MyField]
INDEXED_VALUE = false
What do you get when you do. Do you see PCIDSS as multi-value field?
index=main | table PCIDSS
You could also try
index=main PCIDSS="*11.1.2.a*"
Searching with the wildcard works great. Table how ever, is not expanded.
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
11.1.a
11.1.b
11.1.c
11.1.d
11.1.1
11.1.2.a
11.1.2.b
You have to use the mvexpand
command to expand the table. You can either do
index=main | mvexpand PCIDSS | search PC....
OR index=main PCIDSS="*11.1.2.a*" | mvexpand