topic Re: mvexpand not extracting all key/value pairs in Splunk Search

Why is mvexpand not extracting all key/value pairs?

jmartens — Fri, 17 Mar 2023 16:04:17 GMT

I am trying to expand multiple fields from specific log lines using mvexpand but for some strange reason some fields are not extracted as expected, see screenshot for an example:

I would also like to have the key/value pairs for col and gantry.

Re: mvexpand not extracting all key/value pairs

richgalloway — Thu, 16 Mar 2023 20:13:35 GMT

This is not an mvexpand problem because the values field is not a multi-value field. We know it can't be a multi-value field because the rex command does not use the max_match option, which means only the first match of the regex will be extracted.

The fields that were extracted probably are the result of automatic extraction because they're in key=value format. I can't explain why the col and gantry fields were not extracted.

What is the end goal of this query? The mvexpand command puts each value of a multi-value field into a new event - is that what is desired?

Re: mvexpand not extracting all key/value pairs

jmartens — Fri, 17 Mar 2023 19:20:57 GMT

@richgalloway wrote:
We know it can't be a multi-value field because the rex command does not use the max_match option, which means only the first match of the regex will be extracted.

I don't see why the regex here is such a proof. The `rex` is used to extract two named fields, of which the latter contains the values I am after and is assigned to values. I see no reason why `max_match` is even relevant here.

@richgalloway wrote:
What is the end goal of this query? The mvexpand command puts each value of a multi-value field into a new event - is that what is desired?

The end goal is to extract all values (as per column headings from the results in my screenshot) from value field extracted using the regular expression and assigning them to the event so I can process and plot these values.

Re: mvexpand not extracting all key/value pairs

richgalloway — Fri, 17 Mar 2023 19:53:45 GMT

The max_match option is relevant because its absence tells me we're not dealing with a mutli-value field and so the mvexpand command is not of use.

To get each component of the values field into its own field we need to parse it. There is the extract command, but it only works with _raw so we have to jump through some hoops to use it.

<<your search to extract the values field>> | eval _raw = values | extract pairdelim=, kvdelim== | table values count max min avg col gantry energy

Re: mvexpand not extracting all key/value pairs

jmartens — Mon, 20 Mar 2023 08:09:18 GMT

I had indeed resolved it using in the mean time:

| extract pairdelim="," kvdelim="=" clean_keys=t