I have created a multivalue parser from suggestions in the Splunk answers in the following form:
[stats count | eval src="$dashInSrc$" | makemv src delim="," | mvexpand src | fields src]
But what I would like to have happen is at the end of each value append the asterisk to broaden my search to values that might not be complete at input for the values of the fields in the events; i.e. these are hostnames being input and I would like to include * so that when the event logs the value as the FQDN it will grab that event as well.
↧