Splunk Search

Field extraction on post multikv field?

Simon_Shelston
Splunk Employee
Splunk Employee

Is it possible to create a field extraction on a field that only exists after piping through multikv?

In other words, can I persist this:

index="os" sourcetype="netstat" | multikv | rex field=LocalAddress "(?<port>\d{5})$"
Tags (1)
0 Karma
1 Solution

Simon_Shelston
Splunk Employee
Splunk Employee

No, Splunk will not extract fields that are only present post multikv. This extraction will need to be based on the _raw field.

View solution in original post

0 Karma

Simon_Shelston
Splunk Employee
Splunk Employee

No, Splunk will not extract fields that are only present post multikv. This extraction will need to be based on the _raw field.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

okay, i just edited it and saw the tag was htmlized away. so that should work as is. just can't make it auto whatever.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Well, to clarify, it will do almost just as you've set up above (though you're missing a field name for the extraction), it just can't be set up as an automatic extraction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...