topic Re: How do I create a multivalue field with an eval function? in Splunk Enterprise Security

How do I create a multivalue field with an eval function?

ejwade — Tue, 29 Sep 2020 21:04:06 GMT

I need to create a multivalue field using a single eval function.

I'm using Splunk Enterprise Security and a number of the DNS dashboards rely on the field "message_type" to be populated with either "QUERY" or "RESPONSE".

In Bro DNS logs, query and response information is combined into a single event, so there is not Bro equivalent to message_type. To get around this (without having to change all the dashboards and affect other DNS data sources), I'm hoping to create a calculated field in the Bro app that will be multivalued with "QUERY" and "RESPONSE" as the values. I wanted to do something like this:

| eval message_type = "QUERY,RESPONSE" | makemv delim="," message_type

But the calculated fields don't seem to like piping functions, or functions that aren't eval. Any ideas?

Re: How do I create a multivalue field with an eval function?

kamlesh_vaghela — Mon, 27 Aug 2018 17:06:09 GMT

@ejwade

Have you tried this?

| eval message_type = "QUERY,RESPONSE" | eval message_type=split(message_type,",")

Re: How do I create a multivalue field with an eval function?

ejwade — Mon, 27 Aug 2018 18:25:25 GMT

That's a great suggestion. Unfortunately, it doesn't seem like calculated fields can pipe multiple eval expressions.

Also, they don't allow chaining multiple calculated fields together - all calculated fields are processed in parallel. I need to be able to create a field with value "QUERY,RESPONSE" and then reference this as multivalue in another field (can be new, can be same).

Re: How do I create a multivalue field with an eval function?

DalJeanis — Mon, 27 Aug 2018 22:21:06 GMT

One (chain the two eval items)

| eval message_type=split( "QUERY,RESPONSE",",")

Two (better, use mvappend)

| eval message_type=mvappend("QUERY","RESPONSE")

Re: How do I create a multivalue field with an eval function?

ejwade — Mon, 27 Aug 2018 22:47:45 GMT

That was 100% the right approach. Thank you DalJeanis and kamlesh_vaghela for your help!

Re: How do I create a multivalue field with an eval function?

bkirk — Wed, 07 Nov 2018 15:16:51 GMT

Did you add this to the CIM for DNS resolution? I tried changing the Eval Expression in the CIM, and it breaks the datamodel.

Error in 'eval' command: The arguments to the 'mvappend' function are invalid.

Re: How do I create a multivalue field with an eval function?

bkirk — Tue, 29 Sep 2020 21:56:26 GMT

This is what I added to the CIM and it worked I missed some quotes on the mvappend:
if(index=bro,mvappend("QUERY","RESPONSE"),if(isnull(message_type) OR message_type="","unknown",message_type))

Re: How do I create a multivalue field with an eval function?

ejwade — Tue, 29 Sep 2020 21:59:57 GMT

bkirk - I updated the calculated field "message_type" in props.conf instead of trying to manipulate its eval statement in the data model. The eval statement for message_type in the data model is good as it is, because it sets the value to message_type if it exists, otherwise, "unknown"

I put this in my props:

# Match all bro_* sourcetypes.
[(?::){}bro_*]

EVAL-message_type = split("QUERY,RESPONSE",",")