topic Re: mkvalue - strange problem in Knowledge Management

mkvalue - strange problem

adamguzek — Wed, 07 May 2014 12:10:04 GMT

Log line:

eventDate="2014-03-24 14:42:00.945" eventType="adam.test" eventDevice="test.client" dstip="44.184.5.99" srcip="44.184.5.99" domain="value6" domain="value9" ver="5" dstport="5" srcport="4" user="value4" proto="value8"

Search:

eventType="adam.test" | eval domain1=mvindex(domain,1)

Result? Everything but no domain1 field.

I am trying to search by second or first "domain" field value eval'ing it into domain1 - no luck.

Re: mkvalue - strange problem

richgalloway — Wed, 07 May 2014 12:19:05 GMT

Run the following search to see what exactly Splunk has indexed from that log line.

eventType="adam.test" | table *

That should give you a better idea about how to build your query.

Re: mkvalue - strange problem

adamguzek — Wed, 07 May 2014 12:40:28 GMT

You are right, Splunk indexed only one value for domain field... but why?

Where and how should I configure that source to index data correctly?

Re: mkvalue - strange problem

richgalloway — Wed, 07 May 2014 13:56:02 GMT

The changes needed depend on how you're indexing the data now. Adding 'MV_ADD=true' to your props.conf file may be enough. Providing your current relevant props.conf (and transforms.conf) stanzas will help us help you better.

Re: mkvalue - strange problem

adamguzek — Wed, 07 May 2014 14:21:28 GMT

MV_ADD=true was the trick...