topic How to correlate to multi-value fields from one event? in Splunk Search

How to correlate to multi-value fields from one event?

gnostic_device — Fri, 01 Apr 2022 15:38:36 GMT

Hello,

I have logs where there are multiple values for two fields. This data looks like this example below for each event.

dest

user

builtinadmin

computer1

user1
user2

true

false

It comes from this raw data:

Is there a way to show the data like this instead where each user correctly correlates to the builinadmin value?

dest	user	builtinadmin
computer1	user1	true
computer1	user2	false

Re: How to correlate to multi-value fields from one event

kamlesh_vaghela — Thu, 31 Mar 2022 17:49:22 GMT

@gnostic_device

Can you please try this?

My Sample Search :

| makeresults | eval _raw="<computer N=computer1 D=corp OS=Windows DC=false><users><user N=\"user1\" builtinadmin=\"false\" /><user N=\"user2\" builtinadmin=\"true\" /></users></computer>" | spath | rename "computer{@N}" as dest, "computer.users.user{@N}" as user, "computer.users.user{@builtinadmin}" as builtinadmin | table dest user builtinadmin | rename comment as "Upto now is for sample data only" | eval t=mvzip(user,builtinadmin,"|") | mvexpand t | eval user=mvindex(split(t,"|"),0),builtinadmin=mvindex(split(t,"|"),1) | table dest user builtinadmin

Thanks
KV

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: How to correlate to multi-value fields from one event

mayurr98 — Thu, 31 Mar 2022 17:49:57 GMT

Hey

Not sure if there is any other easy way to do this but you can give this a try:

let me know if this helps!

Re: How to correlate to multi-value fields from one event

yuanliu — Fri, 01 Apr 2022 09:49:24 GMT

Since your data is in XML, here is an alternative to mvzip-split combination, using path option in builtin function spath.

| rename computer{@N} AS dest ``` you already did this in your original search ``` | spath path=computer.users output=users ``` retain complete path as a single XML field ``` | eval users = split(users, " ") ``` for some reason users is single string; turn into multivalue ``` | mvexpand users | spath input=users ``` extract user attrib from XML after mvexpand ``` | rename user{@N} as user, user{@builtinadmin} as builtinadmin ``` do this AFTER mvexpand, not before ``` | table dest user builtinadmin

Sample data gives

dest	user	builtinadmin
computer1	user1	false
computer1	user2	true