topic Re: Extracting multiple values from single unstructured event in Splunk Search

Extracting multiple values from single unstructured event

dkgs — Fri, 28 Aug 2020 08:03:53 GMT

Hi,

In a single event, we have a field named username which is occurring multiple time in the events in raw data and username are different. How can we extract this username field since there are multiple values in the same event. Please help, this is the SAP spool data which is forwarded to splunk cloud. Attaching the screensho with mutiple usernames in single event

Re: Extracting multiple values from single unstructured event

ITWhisperer — Fri, 28 Aug 2020 08:28:10 GMT

Looks like you need something like

... | rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s" | mvexpand user

Re: Extracting multiple values from single unstructured event

dkgs — Fri, 28 Aug 2020 12:12:31 GMT

@ITWhisperer Thank you , the expression is working fine in search.

When I am trying to give the same expression while extracting fields, so that the field user will be permanent, Its not working. I had chosen 'I prefer to write the regular expression myself ' and had added the expression. But I am not able to view the field.Could you please suggest whats causing the issue, but the same is working in search.

Attaching screenshot for reference. Please suggest if its the same way we have to give regular expression while extracting fields

Re: Extracting multiple values from single unstructured event

ITWhisperer — Fri, 28 Aug 2020 13:51:02 GMT

Hi @dkgs

You can only provide the expression

LINE\":\"\|(?<user>[^\s]*)\s

Unfortunately, I can't see a way of providing the max_match=0 part so you will only be able to extract the first match.

To get all the instances in a multivalue field on a more permanent basis, you may have to adopt the transforms and props configuration approach