Splunk Search

Multi Value Field with Auto Extracted Field

msettipane
Splunk Employee
Splunk Employee

Can Splunk be configured to create a multi value field with auto extracted "name=value" fields.

11/2/11 08:03:00 field-one=who, field-one=what, field-one=where, field-one=why, field-one=when

field_one = who,what,where,why,when

sdwilkerson
Contributor

Matty,

I just stumbled onto this and had the same issue last week. I saw a solution posted by Nick here: http://splunk-base.splunk.com/answers/10708/how-do-i-combine-mv-fields-into-a-new-field?page=1&focus...

I took that solution and wrapped it into a macro so I could call it at will from the CLI like this:

eventtype=data | `combine_two_fields(field1,field2,final_field)`

This worked splendidly and is definitely "a keeper."

0 Karma

Ayn
Legend

Without having tested it myself, perhaps mvcombine can do the trick?

0 Karma

msettipane
Splunk Employee
Splunk Employee

Nope. Tried all of the mvs. Everything will work if you use a rex with max_match; however, cannot get it working with auto extracted fields.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...