mkvalue - strange problem

[adamguzek]

Log line:

eventDate="2014-03-24 14:42:00.945" eventType="adam.test" eventDevice="test.client" dstip="44.184.5.99" srcip="44.184.5.99" domain="value6" domain="value9" ver="5" dstport="5" srcport="4" user="value4" proto="value8"

Search:

eventType="adam.test" | eval domain1=mvindex(domain,1)

Result? Everything but no domain1 field.

I am trying to search by second or first "domain" field value eval'ing it into domain1 - no luck.

[richgalloway · Accepted solution]

The changes needed depend on how you're indexing the data now. Adding 'MV_ADD=true' to your props.conf file may be enough. Providing your current relevant props.conf (and transforms.conf) stanzas will help us help you better.

[adamguzek]

MV_ADD=true was the trick...

[adamguzek]

You are right, Splunk indexed only one value for domain field... but why?

Where and how should I configure that source to index data correctly?

[richgalloway]

Run the following search to see what exactly Splunk has indexed from that log line.

eventType="adam.test" | table *

That should give you a better idea about how to build your query.