topic Re: trying to split one event into multiple events in Splunk Search

trying to split one event into multiple events

rukshar — Fri, 01 Nov 2024 20:13:46 GMT

Please help me to extract multiple values from one single value.

Re: trying to split one event into multiple events

PickleRick — Fri, 01 Nov 2024 21:25:38 GMT

What do you mean by "split"? This is obviously not an event but a result of a search. So adjust your search to not merge all results into multivalued fields (which by the way give you no guarantee that "the same" row from each of those fields correspond to the same event in the original data or whatever data you're summarizing it from).

Re: trying to split one event into multiple events

rukshar — Sat, 02 Nov 2024 03:24:18 GMT

Hello @PickleRick ,

Yes, this is the search on the basis of email logs which is giving me one result and i need that search to be multivalued not single valued as you can see in my snippet its giving statistics 1 rather than 3131 which is actually there in the data.

LOGS:

I need this 3131 to be spiltted into mutiple rows with my other following fields as shown in the previous screenshot. when i am doing mvexpand Computer_name its coming 3131 but as soon as i am applying other fields its not showing the data.

Re: trying to split one event into multiple events

PickleRick — Sat, 02 Nov 2024 10:16:03 GMT

Ouch.

This is a very ugly data.

It's not only unnecessarily complicated and needs a lot of "untangling" to get it parsed properly (so that you cannot write reasonable extractions) it also contains a huge blob of stuff that is effectively separate data points. So if you want to search for just one pf those hosts, you still have to make Splunk dig through whole load of completely irrelevant data.

Additionally, you are doing something to your data because the body field if simply extracted from the json would have just have a long string, not separate fields.

So maybe just post your search as it is. My glass orb is being fixed as we speak.

Re: trying to split one event into multiple events

isoutamo — Sat, 02 Nov 2024 13:24:38 GMT

Please just post your current query inside code block "</>" button when you write your post.
Then mockup what and how you want too see the result. One picture is usually better than thousand words.

Re: trying to split one event into multiple events

rukshar — Sat, 02 Nov 2024 14:08:38 GMT

This is the query i am using in my search. I need my output into mutiple rows.(snippet provided)

index=mail "*tanium*" |spath body |rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN" |rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n" |rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n" |rex field=body max_match=0 "\,(?<Patch_List_Name1>.*)\"\[" |rex field=Patch_List_Name1 max_match=0 "\"(?<Patch_List_Name>.*)\",\"" |rex field=Patch_List_Name1 max_match=0 "\",\""(?<Compliance_status>.*)\" |eval Computer_name=mvappend(Computer_name,Computer_name2) |table Computer_name Compliance_status Patch_List_Name

Re: trying to split one event into multiple events

PickleRick — Sat, 02 Nov 2024 18:57:50 GMT

Ok. So you are simply extracting the fields using some predefined "anchor points". You are in for a treat if ever your "constant" parts of your event change.

It would be best if you could - as I said at the beginning - do something with the data as it goes into your system. Without it any searching across your data will be hugely inefficient.

In current situation it would probably be best to extract whole rows, then do mvexpand and then extract single fields from each line. You could do it by "counting" quotes but there's one caveat. It's trivial if you assume your field's contents cannot contain escaped quotes. It's getting a bit tricky if you can have escaped quotes. It's getting annoyingly complicated if you can have escaped quotes and escaped backslashes in your field values,

Re: trying to split one event into multiple events

ITWhisperer — Sun, 03 Nov 2024 13:14:55 GMT

You could try something like this

| eval _raw=body | multikv forceheader=1

Although you may need to rename the fields afterwards