topic Re: Extract values from a multivalue-field in Splunk Dev

Extract values from a multivalue-field

shoermann — Thu, 23 Feb 2017 08:12:30 GMT

I have a multi-value field that contains IP-Adr and MAC-Adr and want to seprate them into single value fields. Sounds easy but the name of the field is 'host.address{@addr}', because of the xml-parsing.

Something like the following doesn't work because of "Error in 'eval' command: The expression is malformed. Expected ).":

index=network_nmap host.address{@addr}=*
| eval test=mvindex(host.address{@addr},0)

What's my way out? Thanks in advance.

Re: Extract values from a multivalue-field

rjthibod — Thu, 23 Feb 2017 12:37:26 GMT

Have you tried wrapping the field name in single or double quotes.

Like this:

`| eval test=mvindex("host.address{@addr}",0)`

`| eval test=mvindex('host.address{@addr}',0)`

Re: Extract values from a multivalue-field

shoermann — Thu, 23 Feb 2017 13:17:23 GMT

I just tried it with double quotes but it works with single ones.