Splunk Search

Can I create a multivalue _meta field?

adam_reber
Path Finder

I have a use case that uses an indexed field that is configured at input time:

[monitor:///my/input/file1]
_meta = new_field::value1

[monitor:///my/input/file2]
_meta = new_field::value1,value2

Is it possible to make new_field a true multi value field, so that a particular event could have a list of values and I can search on new_field=value1 rather than new_field=value1* or new_field=*value2?

0 Karma

buzzard192
Explorer

I know this is a really old post, but in case someone else comes across this, to create a multivalue _meta field, use this syntax:

_meta = new_field::value1  new_field::value2
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@adam.reber - Were you able to test out gvmorley's solution? Did it work? If yes, please don't forget to resolve this post by clicking on "Accept". If you still need more help, please provide a comment with some feedback. Thanks!

0 Karma

gvmorley
Contributor

Hi,

Maybe not exactly what you're looking for, but for different sources / sourcetypes, you could add an EVAL in props.conf

EVAL-new_field = mvappend("value1","value2","value3")

Again, just one quick workaround.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...