All Apps and Add-ons

multiple field occurrences

drodman29
Path Finder

I have HTTP logs of the general format:
POST /search.do?sources=Name1&sources=name2&sources=name3&sources=name4

I'm looking for a good way to do stats/pie charts on the sources, but I only get the first value of the field with the default extractors. Suggestions?

0 Karma
1 Solution

somesoni2
Revered Legend

Put this in your props.conf and transforms.conf

props.conf

[YourSourcetype]
...
Other existing Settings
.....
REPORT-mv_sources = xf-mvsrc


transforms.conf

[xf-mvsrc]
REGEX = sources=(?<sources>[^&]+)
MV_ADD = true

Restart/refresh splunk instance after applying the change.

View solution in original post

somesoni2
Revered Legend

Put this in your props.conf and transforms.conf

props.conf

[YourSourcetype]
...
Other existing Settings
.....
REPORT-mv_sources = xf-mvsrc


transforms.conf

[xf-mvsrc]
REGEX = sources=(?<sources>[^&]+)
MV_ADD = true

Restart/refresh splunk instance after applying the change.

drodman29
Path Finder

One small change on the regex sources=(?[^(&|\?)]+)

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...