How do I create a multivalue field with an eval function?

[ejwade]

I need to create a multivalue field using a single eval function.

I'm using Splunk Enterprise Security and a number of the DNS dashboards rely on the field "message_type" to be populated with either "QUERY" or "RESPONSE".

In Bro DNS logs, query and response information is combined into a single event, so there is not Bro equivalent to message_type. To get around this (without having to change all the dashboards and affect other DNS data sources), I'm hoping to create a calculated field in the Bro app that will be multivalued with "QUERY" and "RESPONSE" as the values. I wanted to do something like this:

| eval message_type = "QUERY,RESPONSE" | makemv delim="," message_type

But the calculated fields don't seem to like piping functions, or functions that aren't eval. Any ideas?

[DalJeanis · Accepted solution]

One (chain the two eval items)

| eval message_type=split( "QUERY,RESPONSE",",")

Two (better, use mvappend)

| eval message_type=mvappend("QUERY","RESPONSE")

[ejwade]

That was 100% the right approach. Thank you DalJeanis and kamlesh_vaghela for your help!

[bkirk]

Did you add this to the CIM for DNS resolution? I tried changing the Eval Expression in the CIM, and it breaks the datamodel.

Error in 'eval' command: The arguments to the 'mvappend' function are invalid.

[bkirk]

This is what I added to the CIM and it worked I missed some quotes on the mvappend:
if(index=bro,mvappend("QUERY","RESPONSE"),if(isnull(message_type) OR message_type="","unknown",message_type))

[ejwade]

bkirk - I updated the calculated field "message_type" in props.conf instead of trying to manipulate its eval statement in the data model. The eval statement for message_type in the data model is good as it is, because it sets the value to message_type if it exists, otherwise, "unknown"

I put this in my props:

# Match all bro_* sourcetypes.
[(?::){}bro_*]

EVAL-message_type = split("QUERY,RESPONSE",",")

[kamlesh_vaghela]

@ejwade

Have you tried this?

| eval message_type = "QUERY,RESPONSE" | eval message_type=split(message_type,",")

[ejwade]

That's a great suggestion. Unfortunately, it doesn't seem like calculated fields can pipe multiple eval expressions.

Also, they don't allow chaining multiple calculated fields together - all calculated fields are processed in parallel. I need to be able to create a field with value "QUERY,RESPONSE" and then reference this as multivalue in another field (can be new, can be same).