Splunk Search

why transaction does not create mv-fields?

marcokrueger
Path Finder

hi,
we have a transaction that doesn't generate mv-fields but a single field with blank-seperated values like starttime="123 345 4565" instead of the expected starttime="123" starttime="345" starttime="4556".

If we reduce the number of events it works fine.

best regards Marco

0 Karma
1 Solution

emaccaferri
Communicator

Try using mvlist=t

| transaction mvlist=t yourfield

View solution in original post

emaccaferri
Communicator

Try using mvlist=t

| transaction mvlist=t yourfield

marcokrueger
Path Finder

thank you, this works, if I make a "makemv" after it for every field I need as mv-field. If it is possible, I want to know under which conditions the transaction-command stops to generate mv-fields. I think it a strange behaviour that transaction do it sometimes so and sometimes other...

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...