topic Re: Splitting a multi value field in configuration files in Splunk Search

Splitting a multi value field in configuration files

asieira — Thu, 02 Apr 2015 14:26:52 GMT

I have a JSON data source in which one of the fields contains a comma separated list of values. Is there a way to use configuration files (rather than using split during the search as indicated in http://answers.splunk.com/answers/53555/splitting-a-multi-valued-field.html) to ensure that this field is extracted as a multi-value field?

Here's one example event:

{ field1=10, field2="blah,bleh,blih" }

I would like field2 to be extracted as a multi-value field with the values blah, bleh and blihwithout the need to explicitly split the value in each search.

Re: Splitting a multi value field in configuration files

somesoni2 — Thu, 02 Apr 2015 15:35:50 GMT

The easiest option would to be setup a calculated field to do this splitting automatically (through configuration files) for field 2.

See this http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/definecalcfields

Anything you can do in an eval field can be done here.

Re: Splitting a multi value field in configuration files

asieira — Mon, 06 Apr 2015 18:25:03 GMT

This allowed me to do exactly what I needed. Thank you!