I am trying to search on the name field by scap-id in the following data. When I search against it Splunk returns one value for the name and throws out the rest. How do I make name a multivalued field. I have included a dataset and my props.conf and transforms.conf.
<controls scap-id='CVE-2010-1241'>
<control internal-id='8081023'>
<name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='8081024'>
<name>Updates for Windows Applications::Adobe Reader 8.2.2 Available - Adobe Reader 8.2.1 (French)</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='8091029'>
<name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>3</passed>
<failed>1</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='8091030'>
<name>Updates for Windows Applications::Adobe Reader 9.3.2 Available - Adobe Reader 9.3/9.3.1 (French)</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='9081021'>
<name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='9081022'>
<name>Updates for Windows Applications::Adobe Acrobat 8.2.2 Available - Adobe Acrobat 8.2/8.2.1 (French)</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='9091019'>
<name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
<control internal-id='9091020'>
<name>Updates for Windows Applications::Adobe Acrobat 9.3.2 Available - Adobe Acrobat 9.3/9.3.1 (French)</name>
<release-date>Tue, 13 Apr 2010</release-date>
<statistics>
<scanned>4</scanned>
<passed>4</passed>
<failed>0</failed>
<patched>0</patched>
<mean-patch-time-hours>NaN</mean-patch-time-hours>
</statistics>
<exceptions>
<has-exception>false</has-exception>
<use-exception>true</use-exception>
<exempt-count>0</exempt-count>
</exceptions>
</control>
</controls>
props.conf
[bigfix]
#TIME_PREFIX = <Extended_Timestamp>
#MAX_TIMESTAMP_LOOKAHEAD = 200
#MUST_BREAK_AFTER = </controls>
#BREAK_ONLY_BEFORE_DATE = false
#SHOULD_LINEMERGE = true
#LINE_BREAKER = \>\s*(?=\<control\>)
BREAK_ONLY_BEFORE = <controls\sscap-id
REPORT-bigfix = xml-bigfix
transforms.conf
[xml-bigfix]
MV_ADD = true
Can you verify this works?? My transforms.conf looks like this
[xmlkv_multivalue] REGEX = <(.?)(?:\s[^>])?>([^<]*) FORMAT = $1::$2 MV_ADD = true
[xml_bigfix] REGEX = /])?/>([^\<])\<\/name
and when I search I pipe to either on the search line and get only one value per xml pair not multiples as advertised...
Thanks I would now like a tabular report which looks like this
scap_id
name
name
name
etc...
I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help
[xml-bigfix]
REGEX = /<name(?:\s[^\>]*)?/>([^\<]*)\<\/name
If you don't mind having many lines for each sscap-id: first expand the multivalued field to multiple events, then use table: "... | mvexpand name | table _time scap-id name"
Sounds like you want "chart count over scap_id by name"
Thanks I would now like a tabular report which looks like this scap_id name name name etc... I can't seem to figure it out. I have tried stats list(name) by scap_id, stats values(name) by scap_id. Help