Getting Data In

Help with Parsing multivalue fields

topher1
Engager

Can anyone help me with extracting/parsing the multivalue fields  in sample event below using props and transforms conf.

{\"ts\":1660880406.308522,\"uid\":\"CKFf5h2a9xFmkGFeFj\",\"id.orig_h\":\"10.10.10.16\",\"id.orig_p\":64179,\"id.resp_h\":\"8.8.4.4\",\"id.resp_p\":53,\"proto\":\"udp\",\"trans_id\":50808,\"rtt\":0.12951111793518067,\"query\":\"discord.com\",\"qclass\":1,\"qclass_name\":\"C_INTERNET\",\"qtype\":1,\"qtype_name\":\"A\",\"rcode\":0,\"rcode_name\":\"NOERROR\",\"AA\":false,\"TC\":false,\"RD\":true,\"RA\":true,\"Z\":0,\"answers\":[\"162.159.135.232\",\"162.159.138.232\",\"162.159.137.232\",\"162.159.136.232\",\"162.159.128.233\"],\"TTLs\":[300.0,300.0,300.0,300.0,300.0]

 

Labels (2)
0 Karma
1 Solution

topher1
Engager

Well, I actually figured it out using the split command....after I posted for help.

>>Transforms.conf
[multivalue_regex_field_extraction]
REGEX = \\"([\w|.]+)\\":\[\\?"?([^\]]+?)\\?"?\]
FORMAT = $1::$2
CLEAN_KEYS = false

>>>Props.conf
REPORT-regex_field_extraction = multivalue_regex_field_extraction
EVAL-answers = split(answers,"\\\",\\\"")
EVAL-TTLs = split(TTLs,",")

Works great!

View solution in original post

Tags (1)

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  Are you looking fo rindex-time extractions or search-time extractions?

---
If this reply helps you, Karma would be appreciated.
0 Karma

topher1
Engager

Well, I actually figured it out using the split command....after I posted for help.

>>Transforms.conf
[multivalue_regex_field_extraction]
REGEX = \\"([\w|.]+)\\":\[\\?"?([^\]]+?)\\?"?\]
FORMAT = $1::$2
CLEAN_KEYS = false

>>>Props.conf
REPORT-regex_field_extraction = multivalue_regex_field_extraction
EVAL-answers = split(answers,"\\\",\\\"")
EVAL-TTLs = split(TTLs,",")

Works great!

Tags (1)
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...