Field extraction into multivalue field

Steve_Litras — Thu, 17 Feb 2011 08:52:59 GMT

So I want to do a general field extraction of IP addresses for a sourcetype that may have them in multiple places in a given event, and may have multiples of them. Something as simple as an inline field extraction like this:

EXTRACT-mv_ip = (?\d+.\d+.\d+.\d+)

However, I'd like all occurrences to be stored in the mv_ip field as a multi value field, and I'd like to be able to use that multi value field in lookups. For some reason, I'm not understanding the documentation on field extractions enough to figure out how to do this.

Example data:

src=10.38.10.89 dst=10.188.10.50 src_port=45045 dst_port=53 src-xlated ip=10.38.12.89 port=45045 dst-xlated ip=10.188.12.50

How I'd like the mv_ip value to end up:

mv_ip = 10.38.10.89,10.188.10.50,10.38.12.89,10.188.12.50

Is this doable? If so, what am I missing?

thanks, Steve

Re: Field extraction into multivalue field

Ron_Naken — Thu, 17 Feb 2011 09:40:08 GMT

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

Re: Field extraction into multivalue field

Steve_Litras — Fri, 18 Feb 2011 00:38:32 GMT

Thanks - worked like a charm...

topic Re: Field extraction into multivalue field in Splunk Search

Field extraction into multivalue field

Re: Field extraction into multivalue field

Re: Field extraction into multivalue field