topic Re: How to create multiple files from a single file? in Splunk Search

How to create multiple files from a single file?

lenafried — Wed, 01 Apr 2015 15:00:20 GMT

I’m analyzing events that may contain one or more file names. Extracting a file name when there’s only one per event is easy. With multiple file names, only the first one is recognized. Consecutive file names are separated by a comma followed by a space. I’d like to create a separate event for each file name in the event. The number of filenames listed in an event is unknown. Events look like this:

Event A: _time, IP, user, etc. ….Added files: Filename1, Filename2, Filename3, etc.

Desired results would be:

Event A: _time, IP, user, etc. ….Added files: Filename1
Event B: _time, IP, user, etc. ….Added files: Filename2
Event C: _time, IP, user, etc. ….Added files: Filename3

I’m new and have not yet used configs/advanced features so I’m looking for a relatively straightforward solution, if possible.
Thank you.

Re: How to create multiple files from a single file?

yannK — Wed, 01 Apr 2015 15:05:51 GMT

If you have an event with several time the same field, look for multivalue field extractions.
then you can decide to split events.

look at the option : multivalue in http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms

and later how to split them http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Parsemultivaluefields

Re: How to create multiple files from a single file?

lenafried — Mon, 06 Apr 2015 23:56:46 GMT

Titles are separated by "," (no spaces) so I used |makemv delim=","|mvexpand Title| and it worked, for the most part.

How can I avoid creating new events due to commas that may be embedded in the Title's text, primarily dates and numbers (e.g., October 2, 2009 and 1,234,567)?

Thanks.