Splunk Search

Is there a makemv to mvexpand command issue in my search?

rdownie
Communicator

When running this search (the return value is hard coded, it is coming from an external command). I just pasted the results in the eval. It shouldn't make a difference.
Search:

|makeresults | eval return="1496410321;A;B# 1496410321;C;D# 1496410321;D;F# 1496413441;G;H# 1496413921;I;J# 1496413935;K;L#" |makemv delim="#" return | mvexpand return | rex field=return "(?P[^;]+);(?P[^;]+);(?P[^;]+)"  | eval dsrv_time=dsrv_timestamp | convert ctime(dsrv_time) | 
 table dsrv_timestamp,dsrv_time,dsrv_host,dsrv_file_name

The convert ctime(dsrv_timestamp) only works on the first event? Why is it not acting on each event?

dsrv_timestamp      dsrv_time       dsrv_host       dsrv_file_name  
1496410321  06/02/2017 09:32:01         A                 B
1496410321                             C                D
1496410321                             D                F
1496413441                             G                H
1496413921                             I                J
1496413935                             K                L

Any help with this would be appreciated.
Thanks

Tags (3)
0 Karma
1 Solution

micahkemp
Champion

There's a space after your # delimiter, which is throwing off your timestamp calcs. Try this:

| makeresults 
| eval return="1496410321;A;B# 1496410321;C;D# 1496410321;D;F# 1496413441;G;H# 1496413921;I;J# 1496413935;K;L#" 
| makemv delim="#" return 
| mvexpand return 
| rex field=return "\s*(?P<dsrv_timestamp>[^;]+);(?P<dsrv_host>[^;]+);(?P<dsrv_file_name>[^;]+)" 
| eval dsrv_time=dsrv_timestamp 
| convert ctime(dsrv_time) 
| table dsrv_timestamp,dsrv_time,dsrv_host,dsrv_file_name

View solution in original post

micahkemp
Champion

There's a space after your # delimiter, which is throwing off your timestamp calcs. Try this:

| makeresults 
| eval return="1496410321;A;B# 1496410321;C;D# 1496410321;D;F# 1496413441;G;H# 1496413921;I;J# 1496413935;K;L#" 
| makemv delim="#" return 
| mvexpand return 
| rex field=return "\s*(?P<dsrv_timestamp>[^;]+);(?P<dsrv_host>[^;]+);(?P<dsrv_file_name>[^;]+)" 
| eval dsrv_time=dsrv_timestamp 
| convert ctime(dsrv_time) 
| table dsrv_timestamp,dsrv_time,dsrv_host,dsrv_file_name

rdownie
Communicator

Ugh!! I banged my head on this for a while. Thanks!!!!!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...