Splunk Search

Help with mv_add and field extractions in transforms.conf

gelica
Communicator

Hi,

I'm using props.conf and transforms.conf to extract my fields but I have some issues with MV_ADD.
My data looks like:

-----
Event1
-----
field1: number1
field2: somehing
field1: number2
-----
Event2
-----
field1: number3

It is possible that different kinds of events have the same field(field1 above) but I want to separate them, and name them like event1_field1, event2_field1.

When I use this regex, the field gets the different values:

REGEX=(?im)field1: (?<field1_value>[[^\r\n]+])
MV_ADD=true

but since I want to separate the fields I tried this, but then I only get the first value of field1..

REGEX=(?im)-{2,}[\r\n]+(Event1)[\r\n.]+-{2,}([^-]+?-?)+?field1: (?<field1_value>[[^\r\n]+])
MV_ADD=true

Can anybody please point me in the right direction?
Thanks

woodcock
Esteemed Legend

Like this:

REGEX=(?im)-{2,}[\r\n]+(Event1)[\r\n.]+-{2,}([^-]+?-?)+?field1: ([[^\r\n]+])
MV_ADD=true
FORMAT $1$2::$3
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...