multiple values for single field in multiple lines of a single multi-lined event

[sf-mike]

Below is my sample log. I'm trying to extract all the 'Pend Reason' codes and still maintain the host field which I'm extracting from the appserver line at the top. I've tried numerous combos but can't make it work. Please help!

Please ignore the extra font formatting in the example.

The TriZetto Group, Inc cerbnav0
Batch Router Module
Version 5.01.00.9 Mar 11 2012 08:46:31
Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved.

Application Server: MLTTSAPV164
Process ID        : 5932
User              : svcFAPTst

*-- Standard Error --*
================================
Initialization Phase Started.

Actual Run Start Date and Time     [11/26/2012 10:12:46.959]

Initialization Phase Complete.
================================
================================
Execution Phase Started.


The TriZetto Group, Inc cmcbclmu
Claims Multi-Eng Electronic Adjud. Program
Version 5.01.00.5 Apr 30 2012 16:36:32
Copyright © 1997-2011 The TriZetto Group, Inc. All rights reserved.

Application Server: MLTTSAPV165
Process ID        : 5932
User              : svcFAPTst

*-- Standard Error --*
================================
Initialization Phase Started.

Actual Run Start Date and Time     [11/26/2012 10:12:46.959]

Initialization Phase Complete.
================================
================================
Execution Phase Started.

Facets - Error: 11/26/2012 10:12:49.284
Return Code: 8
Error Code: 51301
Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 56 Warning Text =  0056-HOLD ALL CLAIMS FOR THIS PROVIDER
Pend Reason =  XC01 WMWM
Solution:  

Facets - Error: 11/26/2012 10:12:49.284
Return Code: 8
Error Code: 51301
Error Message: 823815090500 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 550 Warning Text =  PRPR-0046: PEND CLAIM TO PV03 
Pend Reason =  XC01 WMWM
Solution:  

Facets - Error: 11/26/2012 10:12:53.487
Return Code: 8
Error Code: 51301
Error Message: 823796580000 Pended due to Security Violation. Warning Message limit exceeds User limit
Warn Number = 570 Warning Text =  IPCD-0013:  RMN CODE  (line 1)
Pend Reason =  CE08 WMUD
Solution:  


================================
Termination Phase Started.

Actual Run End Date and Time       [11/26/2012 10:13:31.959]

Termination Phase Complete.
The Highest return code is: 0
================================


Execution Phase Complete.
================================
================================
Termination Phase Started.

Actual Run End Date and Time       [11/26/2012 10:13:32.287]

Termination Phase Complete.
The Highest return code is: 0
================================

[lguinn2]

Here is how I would parse this log:

props.conf

[yoursourcetypehere]
MAX_EVENTS=500
TRUNCATE=0
TIME_PREFIX=Actual Run Start Date and Time\s+\[
MAX_TIMESTAMP_LOOKAHEAD = 25
SHOULD_LINEMERGE=true
MUST_BREAK_BEFORE=The TriZetto Group\, Inc cerbnav0
BREAK_ONLY_BEFORE_DATE = false
EXTRACT-e1=(?m)Application Server: (?<ApplicationServer>\S+)
REPORT-r1 = mv-pendreason

transforms.conf

[mv-pendreason]
REGEX = (?m)Pend Reason =  (?<PendReason>\S+\s\S+)
MV_ADD = true

Hope that helps/works for you...

[lguinn2]

This should work for zero or more occurrences of "Pend Reason". If there are no occurrences, then there will be no PendReason field. For one occurrence, there will be a single-valued PendReason field. Finally, if there are multiple values, PendReason will be a multi-valued field. Multi-valued fields can be manipulated with a variety of Splunk commands: mvexpand mvcombine nomv and the eval functions: mvcount mvfilter mvindex etc.

[sf-mike]

Thanks! One thing I forgot to mention is that there may be more or less than 2 codes for a 'Pend Reason' line. How would I handle the variance?