topic Re: Parse multivalued field to every line in Splunk Enterprise

How to parse multivalued field to every line?

wvalente2 — Tue, 13 Dec 2022 02:42:35 GMT

Hello Splunkers.

I need help regarding a field with multiple values that must be separated.

I have the following log in the following format:

PostureReport
Policy_Umbrella;Passed
Policy_DLP;Passed
Policy_Kaspersky;Passed
Policy_Domain;Passed
Policy_SCCM;Passed
Police_Firewall_Windows;Failed
Policy_Crownstrike;Passed

I need to separate every Policy with your status.

I tried to use mvindex, mvjoin and them separate the events, mvexpand, but none of these worked for me.

Thank you.

Re: Parse multivalued field to every line

richgalloway — Mon, 12 Dec 2022 17:50:26 GMT

Assuming each line in the log is a separate event then you can use the split function to separate the fields.

| eval policyStatus = split(PostureReport, ";") | eval policy = mvindex(policyStatus, 0), status = mvindex(policyStatus, 1)

Re: Parse multivalued field to every line

bowesmana — Mon, 12 Dec 2022 22:47:08 GMT

Assuming the Police_Firewall_Windows was Policy and it is a single field in a single event, then use rex

| rex field=PostureReport max_match=0 "Policy_(?<Policy>[^;]*);(?<Status>.*)"

which will give you two multi-value fields Policy and Status.

If you want to create separate events for each policy result, then do this instead

| rex field=PostureReport max_match=0 "Policy_(?<Policy_Status>.*)" | fields - PostureReport | mvexpand Policy_Status | rex field=Policy_Status "(?<Policy>[^;]*);(?<Status>.*)"

which will give you a separate event per Policy/Status pair

Re: Parse multivalued field to every line

wvalente2 — Tue, 13 Dec 2022 11:19:32 GMT

The first query work perfectly. I'll try here the final query that I want.

Thank you.