topic Re: Extracting the repeated fields from _raw in Splunk Search

Extracting the repeated fields from _raw

tomarcen — Tue, 16 Dec 2014 03:53:02 GMT

Hi.
I've load splunk with my email logs.
I'm getting all the url's in an email in _raw field.

In an e-mail, if there are 10 hyperlinks, I'm getting all the links as url in _raw , but I need them in a column of a table with url & sender columns.

When I pipe and table the output, I'm getting only the first url as the output In url field.

So how to get all the url's tabled in same column.

Re: Extracting the repeated fields from _raw

kml_uvce — Mon, 28 Sep 2020 18:27:27 GMT

try this
your search| eval url_name=mvjoin(url, ";")|table url_name

Re: Extracting the repeated fields from _raw

tomarcen — Tue, 16 Dec 2014 07:23:59 GMT

That dint work. I tried and got the same output - only the first url is showing.

Problem is all the repeated fields like url or recipients are in same event of splunk..

So, I need a query to get the repeated fields like url or recipient repeated multiple times in same event.

In simple words : in one event, I'm getting multiple recipients but after using the above query also, I'm getting the same result(only the first url or recipient in that event)