topic Re: How to extract a field that appears several times, but with different values for every event? in Splunk Search

How to extract a field that appears several times, but with different values for every event?

fmaldonado6441 — Thu, 19 Mar 2015 22:39:35 GMT

Hello community,

Can you give me a hand with the following case:

I have the following log and desire to extract a field that appears several times, but with different values for every event. The log is a sip server.

The field to be created is "via" with the respective values in front of each of them.

'Via' 'SIP/2.0/UDP 172.20.30.219;rport;branch=z9hG4bK915603406529843-AP;ft=172.20.30.219~13c4' 
'Via' 'SIP/2.0/UDP 172.20.30.218:15060;rport=15060;ibmsid=local.1423076844553_14140521_14153316;branch=z9hG4bK915603406529843' 
'Via' 'SIP/2.0/UDP 172.20.30.218:15060;rport;ibmsid=local.1423076844553_14140520_14153315;branch=z9hG4bK796372520547692' 
'Via' 'SIP/2.0/TLS 172.20.30.219;branch=z9hG4bK0fcbd45fcd1e41df3a54ebe9bc00-AP;ft=33364;received=172.20.30.219;rport=22178' 
'Via' 'SIP/2.0/TLS 172.20.30.41;branch=z9hG4bK0fcbd45fcd1e41df3a54ebe9bc00' 
'Via' 'SIP/2.0/TCP 172.20.30.33;branch=z9hG4bK0fcbd45fcd1e41df3a54ebe9bc00'

and within those same lines is the "branch" field that also has different values.

Re: How to extract a field that appears several times, but with different values for every event?

ramdaspr — Fri, 20 Mar 2015 02:45:56 GMT

.. | rex field=_raw "\'Via\'\s\'(?<viavalue>.*)\'"

viavalue would have the text between the single quote after via

Re: How to extract a field that appears several times, but with different values for every event?

chimell — Fri, 20 Mar 2015 10:20:35 GMT

Hi
You can use this search

 .... | rex field=_raw   "\'Via\'\s\'(?<value>.*)\'" | table value | rename value as via

Tell me if it satisfy you please

Re: How to extract a field that appears several times, but with different values for every event?

fmaldonado6441 — Fri, 20 Mar 2015 14:30:37 GMT

Thanks for your support, but it is not exactly what I'm looking for, is that a single event can have multiple lines with informacińo of "via" so the rex suggesting I only extracts the first match, what I want to achieve is to extract the value of the "via" field displays how many times per event.

Re: How to extract a field that appears several times, but with different values for every event?

fmaldonado6441 — Fri, 20 Mar 2015 14:30:43 GMT

Re: How to extract a field that appears several times, but with different values for every event?

stephanefotso — Mon, 30 Mar 2015 08:52:45 GMT

Means the sample data you gave bellow is a single event? if not, can you give a sample data, where we can see an event with several values of val?

Re: How to extract a field that appears several times, but with different values for every event?

fmaldonado6441 — Mon, 30 Mar 2015 13:32:43 GMT

That's right, what values are in the post are from a single event.

Re: How to extract a field that appears several times, but with different values for every event?

fmaldonado6441 — Mon, 30 Mar 2015 13:38:30 GMT

Hi,

The solution to my problem was given by adding the parameter "MV_ADD = 1" in the transforms.conf file, basically this parameter allowing to make is that extraction will not stop when it finds a match.

props.conf

[sip]
BREAK_ONLY_BEFORE = ^@
NO_BINARY_CHECK = true
disabled = false
REPORT-via-extract = via-extract

transforms.conf

[via-extract]
CLEAN_KEYS = 0
MV_ADD = 1
REGEX = 'Via'\s+'(?<sip_via>[^\']+)

Thank you all for your contributions.