All,
I am unable to search by a mvexpand which I am doing via fields.conf. I am getting the extraction I expect, but searching by that fails.
This search fails, but is based on clicking right in the GUI -
index=main PCIDSS="11.1.2.a"
Reference back to the original post -
https://answers.splunk.com/answers/440752/how-do-i-automatically-run-mvexpand-on-a-field.html
↧