I am looking to return the multiple values I have on my dashboard currently only one shows up. Here is an example:
Key=1,2,3
On my dashboard only the first value ('1') will show up. How can I get all values to show up and this should work no matter how many values may belong to a certain key.
Thanks!
It may depend how you extracted the field. You may have to redefine an extraction regex, then do the makemv parsing.
example : with an event like Key=1,2,3
<mysearch > | rex "Key=(?<Key_singlevalue>[\d,]*) " | eval Key_multivalue=Key_singlevalue | makemv delim="," Key_multivalue | table Key, Key_singlevalue, Key_multivalue
Take a look at the multivalues functions
http://docs.splunk.com/Documentation/Splunk/7.1.2/Search/Parsemultivaluefields