Splunk® Enterprise

Search Reference

Splunk Enterprise version 7.0 is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.

mvexpand

Description

Expands the values of a multivalue field into separate events, one event for each value in the multivalue field. For each result, the mvexpand command creates a new result for every multivalue field.

Syntax

mvexpand <field> [limit=<int>]

Required arguments

field
Syntax: <field>
Description: The name of a multivalue field.

Optional arguments

limit
Syntax: limit=<int>
Description: Specify the number of values of <field> to use for each input event.
Default: 0, or no limit

Usage

You can use evaluation functions and statistical functions on multivalue fields or to return multivalue fields.

Limits

A limit exists on the amount of RAM that the mvexpand command is permitted to use while expanding a batch of results. By default the limit is 500MB. The input chunk of results is typically maxresults or smaller in size, and the expansion of all these results resides in memory at one time. The total necessary memory is the average result size multiplied by the number of results in the chunk multiplied by the average size of the multivalue field being expanded.

If this attempt exceeds the configured maximum on any chunk, the chunk is truncated and a warning message is emitted. If you have Splunk Enterprise, you can adjust the limit by editing the max_mem_usage_mb setting in the limits.conf file. If you have Splunk Cloud and encounter problems because of this limit, file a Support ticket.

Examples

Example 1:

Create new events for each value of multivalue field, "foo".

... | mvexpand foo

Example 2:

Create new events for the first 100 values of multivalue field, "foo".

... | mvexpand foo limit=100

Example 3:

The mvexpand command only works on one multivalue field. This example walks through how to expand an event with more than one multivalue field into individual events for each field value. For example, given these events, with sourcetype=data:

2018-04-01 00:11:23 a=22 b=21 a=23 b=32 a=51 b=24
2018-04-01 00:11:22 a=1 b=2 a=2 b=3 a=5 b=2

First, use the rex command to extract the field values for a and b. Then use the eval command and mvzip function to create a new field from the values of a and b.

source="mvexpandData.csv" | rex field=_raw "a=(?<a>\d+)" max_match=5 | rex field=_raw "b=(?<b>\d+)" max_match=5 | eval fields = mvzip(a,b) | table _time fields


The results appear on the Statistics tab and look something like this:

_time fields
2018-04-01 00:11:23

22,21
23,32
51,24

2018-04-01 00:11:22

1,2
2,3
5,2


Use the mvexpand command and the rex command on the new field, fields, to create new events and extract the alpha and beta values:

source="mvexpandData.csv" | rex field=_raw "a=(?<a>\d+)" max_match=5 | rex field=_raw "b=(?<b>\d+)" max_match=5 | eval fields = mvzip(a,b) | mvexpand fields | rex field=fields "(?<alpha>\d+),(?<beta>\d+)" | table _time alpha beta


Use the table command to display only the _time, alpha, and beta fields in a results table.

The results appear on the Statistics tab and look something like this:

_time alpha beta
2018-04-01 00:11:23 23 32
2018-04-01 00:11:23 51 24
2018-04-01 00:11:22 1 2
2018-04-01 00:11:22 2 3
2018-04-01 00:11:22 5 2

(Thanks to Splunk user Duncan for this example.)

See also

Commands:
makemv
mvcombine
nomv

Functions:
Multivalue eval functions
Multivalue stats and chart functions
split

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the mvexpand command.

Last modified on 10 April, 2018
mvcombine   nomv

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters