Splunk Search

Getting multivalued field values that are truncated by auto field extraction

ken_t_huang
Explorer

Excuse me,
I have a data like this:
index=test, product=a, category="1";"3";"6",.....

how do I set the multi fields to search "3" "6"?
thanks!

Tags (2)
1 Solution

carasso
Splunk Employee
Splunk Employee

None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:

    category="1"  ;"3";"6"

None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...

 index=test product=a category (3 OR 6) |  rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6

I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.

You can play with things and see what's going on, by running this search in the ui.

| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"

(the "|stats count" nonsense is just to make a dummy event with no data).

View solution in original post

carasso
Splunk Employee
Splunk Employee

None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:

    category="1"  ;"3";"6"

None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...

 index=test product=a category (3 OR 6) |  rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6

I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.

You can play with things and see what's going on, by running this search in the ui.

| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"

(the "|stats count" nonsense is just to make a dummy event with no data).

torbael
Explorer

Try this one:

| makemv delim=";" category | mvexpand category | search category="3" OR category="6"

0 Karma

ken_t_huang
Explorer

I have tried this, but it fail to search multi values, just show category="3" or "6"
I need to search all have 3 or 6.

0 Karma

johandk
Path Finder

Something like this might work:

| makemv delim=";" category | search category="\"3"\" category="\"6"\"

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...