topic Re: How to combine duplicate fields in the same event into one field? in Getting Data In

How to combine duplicate fields in the same event into one field?

weznagwama — Mon, 31 Aug 2015 00:38:58 GMT

Hey Guys,

I have events that contains the same field, like so:

12/08/2015 1:03:03 PM Server="exchange" User="admin@domain.com" Identity="bigstring=" Cmdlet="Set-DistributionGroup" Param="-IgnoreNamingPolicy 'True'" Param="-Identity 'Distro Group'" Success="True" Error=""

So as you can see, my event has 2 param fields for the "set-distributionGroup' cmdlet.

I am wondering how to combine this field into one. Thanks!

Re: How to combine duplicate fields in the same event into one field?

sduff_splunk — Mon, 31 Aug 2015 04:17:10 GMT

if you are not getting two Params being field-extracted, you could use a rex and an eval

| rex field=_raw "Param=\"(?<p1>[^\"]*)\" Param=\"(?<p2>[^\"]*)\"" | eval param=p1.p2

Re: How to combine duplicate fields in the same event into one field?

weznagwama — Mon, 31 Aug 2015 04:32:18 GMT

Hey mate,

Thanks for the reply.

Let's assume an event has '4' seperate Params.

Is there a way to field extract to match all? Or would I just have to say regex 10 params, eval p1...p10, to catch up to 10 params?

The issue being that not all events have 2 params...some could have 1 or some could have 6. Thanks again.

Re: How to combine duplicate fields in the same event into one field?

krishnarajapant — Mon, 31 Aug 2015 04:41:32 GMT

Hi weznagwama,

I think you can use "makemv" command with "delim" by mentioning the seperator.

| makemv delim="-" Cmdlet | top Cmdlet

-Krishna Rajapantula

Re: How to combine duplicate fields in the same event into one field?

sduff_splunk — Mon, 31 Aug 2015 04:47:37 GMT

If you don't know how many parameters you are going to have, you can have all the params extracted into a multi-value field called 'oneparam', and then use mvjoin to put them into a single parameter (called params). Each field will be separated by a space.

| rex max_match=0 field=_raw "Param=\"(?<oneparam>[^\"]*)\" | eval params=mvjoin(oneparam, " ")

Re: How to combine duplicate fields in the same event into one field?

somesoni2 — Tue, 01 Sep 2015 14:19:18 GMT

If you logs have the format mentioned above (key-value pair), Splunk should've extracted a multivalued field Param already, which will contain both the Param values. Try running this and see if you can see both values under same field name.

your base search | table Param

Re: How to combine duplicate fields in the same event into one field?

weznagwama — Wed, 02 Sep 2015 04:25:02 GMT

Hey mate, thanks for the reply, I've unfortuntaely got stuck on something else relating to powershell scripts running so can't test this yet....until I get the powershell script working. Will post back once I do.

Re: How to combine duplicate fields in the same event into one field?

weznagwama — Wed, 02 Sep 2015 04:25:43 GMT

Thanks for the reply, I've unfortunately gotten stuck on attempting to get a powershell script working (turns out it's quiet difficult.) Will post back once I get that going. Cheers.