How to extract multivalue data to dynamic fields?

jmartens — Mon, 12 Jun 2023 13:31:04 GMT

I am trying to extract multi value fields and set dynamic fields with values based on the extracted data. I am able to extract the data but am unable to do the last part and generate dynamic fields, only the first is generated:

| makeresults | eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]" | eval temp=split(DICOMQuery,"|") | rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]" | eval {DICOMLabel}=DICOMValue | fields - DICOMQuery DICOMLabel, DICOMValue temp

Which yields the following:

It seems I am nearly there, but I fail to get them as individual searchable fields which is what I am after. Any pointers?

Re: Extract multivalue data to dynamic fields

jmartens — Mon, 12 Jun 2023 09:50:33 GMT

After some more searching I stumbled on mvexpand and had to add it to expand the temp field like this:

| makeresults | eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]" | eval temp=split(DICOMQuery,"|") | mvexpand temp | rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]" | eval {DICOMLabel}=DICOMValue | fields - DICOMQuery DICOMLabel, DICOMValue temp

topic Re: Extract multivalue data to dynamic fields in Splunk Search

How to extract multivalue data to dynamic fields?

Re: Extract multivalue data to dynamic fields