topic Re: Split correspondence of multi value fields in Splunk Enterprise

How to Split correspondence of multi value fields

spl_stu — Fri, 22 Jul 2022 14:14:46 GMT

Please help answer this question, thank you：

For these two multivalued fields, you want the value in the "Recipient" field to correspond to the value in the "recipient_status". If the receipt is successful, it corresponds to ";", If it fails, it corresponds to "'550 5.1.1 resolver.adr.recipnotfound, not found'". Is there a way to segment the values of these two fields and make one-to-one correspondence?

The following are the values corresponding to these two fields
Recipient="@000.com @123.com @456.com @789.com",
recipient_status=";;'550 5.1.1 RESOLVER.ADR.RecipNotFound; not found';"

Re: Split correspondence of multi value fields

ITWhisperer — Fri, 22 Jul 2022 06:21:20 GMT

The recipient appears to be space delimited - how are the status values delimited?

Is what you have given as your example exactly as it is in the raw event or are these representations of the event field post extraction?

Has the data been extracted to a multi-value field (in the Splunk sense) already or are you looking for help to do that extraction?

Re: Split correspondence of multi value fields

spl_stu — Fri, 22 Jul 2022 06:26:28 GMT

These two values are the log content automatically extracted by "add on". The corresponding value of "Recipient" is a field, and the corresponding value is the recipient connected by multiple space characters. The complete value of "status" is this content

Re: Split correspondence of multi value fields

ITWhisperer — Fri, 22 Jul 2022 06:41:17 GMT

Try something like this (this assumes that the status does not have a semi-colon in)

| rex field=recipient max_match=0 "(?<rcpt>\S+)" | rex recipient_status max_match=0 "(?i)(?<rcptstatus>(;|'550 5\.1\.1 resolver\.adr\.recipnotfound, not found'))" | eval recipient_plus_status=mvzip(rcpt, rcptstatus)

Re: Split correspondence of multi value fields

spl_stu — Fri, 22 Jul 2022 06:43:48 GMT

OK, thank you very much for your answer. I'll test it now

Re: Split correspondence of multi value fields

spl_stu — Fri, 22 Jul 2022 07:17:59 GMT

Thank you very much for your answer. My problem has been solved