Knowledge Management

Data models: Does multikv require a root search object?

helge
Builder

Many of my sourcetypes are in CSV format: the first line has the column names, the other lines have the actual data, e.g.:

Name,ID
Peter,1
Paul,2

One Splunk event is equivalent to a CSV file with many lines.

I use the multikv command to split the each multi-line event into individual events. With data models that apparently is only possible when using root searches - I cannot use pipes with constraints. Is that correct?

I am asking because the documentation stresses to use root events wherever possible.

Tags (3)
0 Karma
1 Solution

aneels_splunk
Splunk Employee
Splunk Employee

Correct - you cannot use pipes inside object constraints. If you need the multikv command, then you need to use a search-based object. If you're not planning to accelerate your data model, you're probably fine just using the search-based object.

If not, you can use multikv.conf to set up your extractions to happen automatically. If you do this, the fields will appear in search in the format you need, and you'll be able to build a data model on top of them using event-based objects.

View solution in original post

aneels_splunk
Splunk Employee
Splunk Employee

Correct - you cannot use pipes inside object constraints. If you need the multikv command, then you need to use a search-based object. If you're not planning to accelerate your data model, you're probably fine just using the search-based object.

If not, you can use multikv.conf to set up your extractions to happen automatically. If you do this, the fields will appear in search in the format you need, and you'll be able to build a data model on top of them using event-based objects.

stephenho
Path Finder

Hi, I've set up my multikv.conf file and i'm able to actually call it using

base search | multikv conf=mymultikvconf

Using the multikv command, I can see all the fields listed in my field picker.

However, the fields don't seem to appear automatically if I just do the base search.

My multikv.conf file lives within the local folder of my app.

I used the documentation listed here : -

http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Multikvconf

Is there something I've missed?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...