Splunk Search

Extracting multiple field values with same field name

splunkingsplun1
Explorer

Can anyone provide assistance for extracting multiple field values with same field name? My log is something like this:

10:10:34 scan_date="2014-05-24 10:10:34" ip=192.168.1.1 port=445 protocol=tcp results="- NULL sessions are enabled on the remote host " cve=CVE-1999-0503 cve=CVE-1999-0504 cve=CVE-1999-0505 cve=CVE-1999-0506 cve=CVE-2000-0222 cve=CVE-2002-1117 mskb=Q132679 mskb=Q143474 mskb=Q289655

As you can observe I have multiple CVE and MSKB values and Splunk stops after extracting first value. I would like to extract all of them. Any suggestions? Any input would be helpful.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi splunkingsplunker,

have you tried adding MV_ADD in transforms.conf for that sourcetype?

MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which already exists.
* If set to true, the extractor makes the field a multivalued field and appends the 
* newly found value, otherwise the newly found value is discarded.
* Defaults to false

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...