topic Data models: Does multikv require a root search object? in Knowledge Management

Data models: Does multikv require a root search object?

helge — Mon, 28 Oct 2013 15:06:46 GMT

Many of my sourcetypes are in CSV format: the first line has the column names, the other lines have the actual data, e.g.:

Name,ID
Peter,1
Paul,2

One Splunk event is equivalent to a CSV file with many lines.

I use the multikv command to split the each multi-line event into individual events. With data models that apparently is only possible when using root searches - I cannot use pipes with constraints. Is that correct?

I am asking because the documentation stresses to use root events wherever possible.

Re: Data models: Does multikv require a root search object?

aneels_splunk — Mon, 28 Oct 2013 19:04:41 GMT

Correct - you cannot use pipes inside object constraints. If you need the multikv command, then you need to use a search-based object. If you're not planning to accelerate your data model, you're probably fine just using the search-based object.

If not, you can use multikv.conf to set up your extractions to happen automatically. If you do this, the fields will appear in search in the format you need, and you'll be able to build a data model on top of them using event-based objects.

Re: Data models: Does multikv require a root search object?

stephenho — Thu, 04 Sep 2014 23:01:36 GMT

Hi, I've set up my multikv.conf file and i'm able to actually call it using

base search | multikv conf=mymultikvconf

Using the multikv command, I can see all the fields listed in my field picker.

However, the fields don't seem to appear automatically if I just do the base search.

My multikv.conf file lives within the local folder of my app.

I used the documentation listed here : -

http://docs.splunk.com/Documentation/Splunk/6.0.5/Admin/Multikvconf

Is there something I've missed?