Splunk Search

How to handle events where the same field occurs multiple times?

Ant1D
Motivator

Hey,

I have some data that looks like this:

Jan 01 01:02:03 host123 serial123 Version=1.0, Check=01 , Check=02 , Check=03 , Check=04 , Check=05 , Server=ABC, Server=DEF

Splunk is currently only extracting the first occurrence of field Check (i.e. 01) and field Server (i.e. ABC) by default.
What do I need to add to the Splunk config to force all occurrences of these fields to be extracted?

Thanks

0 Karma
1 Solution

Ant1D
Motivator

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

The section titled Handling events with multivalue fields seems to be what I am looking for. The below does what I need.

In transforms.conf:

[mv-check]
REGEX = Check=(?<Check>\d+)[,\s]+
MV_ADD = true

In props.conf:

REPORT-mychecks = mv-check

View solution in original post

0 Karma

Ant1D
Motivator

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextrac...

The section titled Handling events with multivalue fields seems to be what I am looking for. The below does what I need.

In transforms.conf:

[mv-check]
REGEX = Check=(?<Check>\d+)[,\s]+
MV_ADD = true

In props.conf:

REPORT-mychecks = mv-check

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can do this through field transformations with the multivalue checkbox checked:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms

0 Karma

Ant1D
Motivator

Hi, thanks for this but it is not what I am looking for. I want the fields "Check" and "Server" to be assigned all of the fields in the event without having to use any additional search commands. Is there Splunk config which will force this to happen?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Looks like I got the wrong link, fixed... that's config only.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are extracting the fields now?

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ant1D
Motivator

Splunk extracts the first occurrence only by default. What I am expecting is for the field "Check" to be assigned values 01, 02, 03, 04 and 05

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...