topic Multiple values per key in one record in Splunk Search

Multiple values per key in one record

blurblebot — Wed, 30 Mar 2011 22:32:08 GMT

If I have records with multiple k/v pairs with the same keyname, can I parse that through Splunk search language or by massaging the confs so that each k/v pair is reflected in the results of searches against it?

For instance, assuming these records are alone in their index:

3/30/2011 04:53:22 index=Org_Personnel Name=Herbert Name=Yancey Name=Bartleby Department=Acquisitions 

3/30/2011 04:53:22 index=Org_Personnel Name=Carol Name=Cyril Name=Lana Name=Mallory Department=IT

(the second line is to illustrate that number of kv pairs can vary from one record to the next)

Now my simple search:

index=Org_Personnel |stats count(name)

How would I make that return "7" instead of "2" as it would without modification?

Thank you in advance.

-s

Re: Multiple values per key in one record

blurblebot — Wed, 30 Mar 2011 22:33:30 GMT

Sorry about the last title. That was bad form.

Re: Multiple values per key in one record

hazekamp — Wed, 30 Mar 2011 22:50:15 GMT

Blurblebot,

You can do this via props/transforms like so. The trick is to use MV_ADD http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf:

## props.conf
[<your_sourcetype>]
REPORT-name_for_your_sourcetype = name_for_your_sourcetype

## transforms.conf
[name_for_your_sourcetype]
REGEX = Name=(\S+)
FORMAT = name::$1
MV_ADD = True

Re: Multiple values per key in one record

ftk — Wed, 30 Mar 2011 22:52:26 GMT

You beat me to it!

Re: Multiple values per key in one record

blurblebot — Wed, 30 Mar 2011 22:55:43 GMT

Beauty. Thanks!

Re: Multiple values per key in one record

blurblebot — Fri, 12 Aug 2011 17:36:57 GMT

Small capitalization correction on your answer:

FORMAT = Name::$1