- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I need to create a multivalue field using a single eval function.
I'm using Splunk Enterprise Security and a number of the DNS dashboards rely on the field "message_type" to be populated with either "QUERY" or "RESPONSE".
In Bro DNS logs, query and response information is combined into a single event, so there is not Bro equivalent to message_type. To get around this (without having to change all the dashboards and affect other DNS data sources), I'm hoping to create a calculated field in the Bro app that will be multivalued with "QUERY" and "RESPONSE" as the values. I wanted to do something like this:
| eval message_type = "QUERY,RESPONSE" | makemv delim="," message_type
But the calculated fields don't seem to like piping functions, or functions that aren't eval. Any ideas?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

One (chain the two eval items)
| eval message_type=split( "QUERY,RESPONSE",",")
Two (better, use mvappend
)
| eval message_type=mvappend("QUERY","RESPONSE")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

One (chain the two eval items)
| eval message_type=split( "QUERY,RESPONSE",",")
Two (better, use mvappend
)
| eval message_type=mvappend("QUERY","RESPONSE")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That was 100% the right approach. Thank you DalJeanis and kamlesh_vaghela for your help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you add this to the CIM for DNS resolution? I tried changing the Eval Expression in the CIM, and it breaks the datamodel.
Error in 'eval' command: The arguments to the 'mvappend' function are invalid.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is what I added to the CIM and it worked I missed some quotes on the mvappend:
if(index=bro,mvappend("QUERY","RESPONSE"),if(isnull(message_type) OR message_type="","unknown",message_type))
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

bkirk - I updated the calculated field "message_type" in props.conf instead of trying to manipulate its eval statement in the data model. The eval statement for message_type in the data model is good as it is, because it sets the value to message_type if it exists, otherwise, "unknown"
I put this in my props:
# Match all bro_* sourcetypes.
[(?::){}bro_*]
EVAL-message_type = split("QUERY,RESPONSE",",")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


@ejwade
Have you tried this?
| eval message_type = "QUERY,RESPONSE" | eval message_type=split(message_type,",")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That's a great suggestion. Unfortunately, it doesn't seem like calculated fields can pipe multiple eval expressions.
Also, they don't allow chaining multiple calculated fields together - all calculated fields are processed in parallel. I need to be able to create a field with value "QUERY,RESPONSE" and then reference this as multivalue in another field (can be new, can be same).
