topic How to index log with table data inside? in Splunk Search

How to index log with table data inside?

shayhibah — Tue, 10 Apr 2018 15:36:58 GMT

Hi,

I have some logs that contain table data inside - which means there are multiple fields with the same key name.
Therefore, when I build my add-on and try to extract the fields using regex, Splunk refer to the 1st occurrence while the others are not index at all.

Is there any option to index the other fields with the same name as they are or by changing their name?

Example:

action = ok; action = canceled; action = ok; id = 1; id = 213; id = 98;

in that case - only the 1st occurrences of action and id will be indexed.

Thanks

Re: How to index log with table data inside?

niketn — Tue, 10 Apr 2018 17:45:10 GMT

@shayhibah, seems like you should use fields.conf with TOKENIZER

Re: How to index log with table data inside?

somesoni2 — Tue, 10 Apr 2018 18:50:59 GMT

Basically this: https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields

Re: How to index log with table data inside?

shayhibah — Wed, 11 Apr 2018 11:30:36 GMT

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

Re: How to index log with table data inside?

shayhibah — Wed, 11 Apr 2018 11:31:03 GMT

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?