Hey,
I have some data that looks like this:
Jan 01 01:02:03 host123 serial123 Version=1.0, Check=01 , Check=02 , Check=03 , Check=04 , Check=05 , Server=ABC, Server=DEF
Splunk is currently only extracting the first occurrence of field Check (i.e. 01) and field Server (i.e. ABC) by default.
What do I need to add to the Splunk config to force all occurrences of these fields to be extracted?
Thanks
The section titled Handling events with multivalue fields seems to be what I am looking for. The below does what I need.
In transforms.conf:
[mv-check]
REGEX = Check=(?<Check>\d+)[,\s]+
MV_ADD = true
In props.conf:
REPORT-mychecks = mv-check
The section titled Handling events with multivalue fields seems to be what I am looking for. The below does what I need.
In transforms.conf:
[mv-check]
REGEX = Check=(?<Check>\d+)[,\s]+
MV_ADD = true
In props.conf:
REPORT-mychecks = mv-check
You can do this through field transformations with the multivalue checkbox checked:
http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms
Hi, thanks for this but it is not what I am looking for. I want the fields "Check" and "Server" to be assigned all of the fields in the event without having to use any additional search commands. Is there Splunk config which will force this to happen?
Looks like I got the wrong link, fixed... that's config only.
How are extracting the fields now?
Splunk extracts the first occurrence only by default. What I am expecting is for the field "Check" to be assigned values 01, 02, 03, 04 and 05