topic Re: Eval condition in props.conf using mvindex? in Splunk Search

Eval condition in props.conf using mvindex?

pavanae — Wed, 30 Sep 2020 01:52:57 GMT

I have a field which contains 2 values for every event as shown below:

Field Name :- Username
Example Values :- A,B

Now from the above example I have defined 2 extra fields first_user and second_user
first_user=A (1st field value from Username)
second_user=B (2nd field value from Username)

Both the above 2 fields work well as long as the Username field has two values but when the Username has only 1 value like the first field(A) is there and the second field(B) is null. I want to display the Null or empty for second_user field but instead right now it just picking up the A value for second_user field.

In order to resolve this, I'm trying to work on a Regex on props.conf by using some if condition and a mvindex command to give the logic something like if the B is null. I want to display null.

Any help on providing the format for regex would be great.

Re: Eval condition in props.conf using mvindex?

somesoni2 — Sat, 24 Aug 2019 00:49:17 GMT

See if something like this works for you

https://regex101.com/r/XdkInV/1

Re: Eval condition in props.conf using mvindex?

pavanae — Wed, 28 Aug 2019 19:45:49 GMT

thanks @somesoni2 regex works good. Now how can I apply that regex on props.conf what is the syntax for that.

Re: Eval condition in props.conf using mvindex?

somesoni2 — Wed, 28 Aug 2019 21:43:22 GMT

If the original field (which has two Username values) is already extract, then follow solution from this :

https://answers.splunk.com/answers/322843/extract-fields-from-an-already-extracted-field.html

If not, then you can setup based on _raw data but would need to adjust the regex then setup like this
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Exampleconfigurationswithprops.conf
https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Exampleconfigurationsusingfieldtransforms

Re: Eval condition in props.conf using mvindex?

woodcock — Wed, 18 Sep 2019 17:39:24 GMT

You can setup a calculated field with this definition:

second_user = coalesce(second_user, "Null")