Hi.
I've load splunk with my email logs.
I'm getting all the url's in an email in _raw field.
In an e-mail, if there are 10 hyperlinks, I'm getting all the links as url in _raw , but I need them in a column of a table with url & sender columns.
When I pipe and table the output, I'm getting only the first url as the output In url field.
So how to get all the url's tabled in same column.
That dint work. I tried and got the same output - only the first url is showing.
Problem is all the repeated fields like url or recipients are in same event of splunk..
So, I need a query to get the repeated fields like url or recipient repeated multiple times in same event.
In simple words : in one event, I'm getting multiple recipients but after using the above query also, I'm getting the same result(only the first url or recipient in that event)
try this
your search| eval url_name=mvjoin(url, ";")|table url_name