Getting Data In

Trouble extracting multivalue fields- How do I separate these fields into their own events?

mistydennis
Communicator

Hi all - I am having trouble pulling out mv fields into separate events. My data looks like this:

Screenshot 2022-09-27 062425.jpg

I'd like to pull each event out into it's own line, but I'm having trouble with the carriage returns and getting the fields to pair correctly (i.e., error 1232 is with server 1). 

Example search:

 

 

 

| makeresults 
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7" 
| makemv delim="
" error 
| makemv delim="
" server 
| eval uniquekey=mvzip(server,error, ":")

 

 

 

 
How do I separate these fields into their own events so the data looks like:

1232 server1 server1:1232
2345 server2 server2:2345
5783 server3 server3:5783
Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mistydennis 

Can you please try this?

YOUR_SEARCH
| eval t = mvzip(mvzip(server,error),uniquekey) 
| mvexpand t 
| rex field=t "(?<server>.*),(?<error>.*),(?<uniquekey>.*)" 
| table server error uniquekey

 

OR

YOUR_SEARCH
| eval t = mvzip(mvzip(server,error),uniquekey)
| mvexpand t 
| eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2)
|table server error uniquekey

 

My Sample Search :

 

| makeresults 
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7" 
| makemv delim="
" error 
| makemv delim="
" server 
| eval uniquekey=mvzip(server,error, ":")
| rename comment as "upto this is sample data" 
| eval t = mvzip(mvzip(server,error),uniquekey)
| mvexpand t 
| eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2)
|table server error uniquekey

 

| makeresults 
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7" 
| makemv delim="
" error 
| makemv delim="
" server 
| eval uniquekey=mvzip(server,error, ":") 
| rename comment as "upto this is sample data" 
| eval t = mvzip(mvzip(server,error),uniquekey) 
| mvexpand t 
| rex field=t "(?<server>.*),(?<error>.*),(?<uniquekey>.*)" 
| table server error uniquekey

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mistydennis 

Can you please try this?

YOUR_SEARCH
| eval t = mvzip(mvzip(server,error),uniquekey) 
| mvexpand t 
| rex field=t "(?<server>.*),(?<error>.*),(?<uniquekey>.*)" 
| table server error uniquekey

 

OR

YOUR_SEARCH
| eval t = mvzip(mvzip(server,error),uniquekey)
| mvexpand t 
| eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2)
|table server error uniquekey

 

My Sample Search :

 

| makeresults 
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7" 
| makemv delim="
" error 
| makemv delim="
" server 
| eval uniquekey=mvzip(server,error, ":")
| rename comment as "upto this is sample data" 
| eval t = mvzip(mvzip(server,error),uniquekey)
| mvexpand t 
| eval server=mvindex(split(t,","),0), error=mvindex(split(t,","),1), uniquekey=mvindex(split(t,","),2)
|table server error uniquekey

 

| makeresults 
| eval error="1232
2345
5783
5689
2345
5678
5901", server="server1
server2
server3
server4
server6
server9
server7" 
| makemv delim="
" error 
| makemv delim="
" server 
| eval uniquekey=mvzip(server,error, ":") 
| rename comment as "upto this is sample data" 
| eval t = mvzip(mvzip(server,error),uniquekey) 
| mvexpand t 
| rex field=t "(?<server>.*),(?<error>.*),(?<uniquekey>.*)" 
| table server error uniquekey

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

 

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...