topic Multivalue field extraction in Splunk Search

Multivalue field extraction

cdstealer — Fri, 18 Mar 2016 08:51:15 GMT

Hi, I'm struggling to get this extracted correctly so it's usable.
The raw data is presented as:

    Privileges: SeSecurityPrivilege
            SeBackupPrivilege
            SeRestorePrivilege
            SeTakeOwnershipPrivilege
            SeDebugPrivilege
            SeSystemEnvironmentPrivilege
            SeLoadDriverPrivilege
            SeImpersonatePrivilege
            SeAssignPrimaryTokenPrivilege

By default, only the first entry is assigned to the field eg:

"SeSecurityPrivilege"

I can extract the remaining lines into the field using the regex "Privileges:\t(?P(\w+\s+|\t\t\t\w+\s+)+)", which returns this:

"SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege"

Now what I need is to split each of these into the Privileges field as separate values.

These values are not a static number of entries, so Privileges could contain anything between 1 and 10 lines.

Any advice would be great as the docs and answers I've read don't seem to help this situation.

TIA
Steve

Re: Multivalue field extraction

fdi01 — Fri, 18 Mar 2016 09:25:27 GMT

try :

  your_base_search|rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"| eval Privileges=split(field_name_extraction, " ")| mvexpand Privileges|...

Re: Multivalue field extraction

cdstealer — Fri, 18 Mar 2016 10:26:57 GMT

Hi fdi01, Thanks. Unfortunately this does not change the output.

Steve

Re: Multivalue field extraction

fdi01 — Fri, 18 Mar 2016 11:26:18 GMT

your rex |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"| capture all results in Privileges field ???

Re: Multivalue field extraction

cdstealer — Fri, 18 Mar 2016 11:52:52 GMT

This is what I'm getting.

Re: Multivalue field extraction

somesoni2 — Fri, 18 Mar 2016 14:04:25 GMT

Give this a try

index=main EventCode="576" |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)" | rex field=Privileges max_match=0 "(?<Privilege>\S+)\s+" | mvexpand Privilege

Re: Multivalue field extraction

alemarzu — Fri, 18 Mar 2016 14:17:47 GMT

Hi cdstealer

Try to add this, after your field extraction.

main search | rex field=_raw ... | makemv delim=" " Privileges | mvexpand Privileges

Hope it helps.

Re: Multivalue field extraction

cdstealer — Fri, 18 Mar 2016 17:09:46 GMT

Perfect! I think you've solved a couple of my past questions. So thank you very much again 🙂

Re: Multivalue field extraction

cdstealer — Fri, 18 Mar 2016 17:10:38 GMT

Thanks to everyone that has offered help. Much appreciated.

Re: Multivalue field extraction

cdstealer — Mon, 21 Mar 2016 07:59:09 GMT

Hi again, Now I'm struggling transferring the search into props/transforms. I'm probably missing something simple.

props.conf:

EXTRACT-Privileges = Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)
REPORT-fields = privilege

transforms.conf:

[privilege]
SOURCE_KEY = Privileges
REGEX = "(?<privilege>\S+)\s+)
REPEAT_MATCH = true
MV_ADD = true

So the new field that contains the extracted values is not happening.

Re: Multivalue field extraction

DavidHourani — Wed, 06 Apr 2016 08:45:22 GMT

Hello, did you manage to solve this ?

Re: Multivalue field extraction

skawasaki_splun — Fri, 22 Jun 2018 03:52:22 GMT

You have an extra " in front of your REGEX in transforms.conf.