I have a event field that comes in as a string that is comma separated.
field look like https://google.con,https://Microsoft.com,https://splunk.com
In my props I have an eval:
EVAL-urls = split(urls, ",")
when searched we only see the https://google.com is the urls field.
How can I make this multivalued ?
Thanks!
can I use a makemv in a props.conf?
Try using the makemv command. This will take a single value field with a delimited list of values and turn it into a multivalued field.
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Makemv
can I use this in a props.conf?
if so what would the command look like?
thanks!