Splunk Enterprise Security
Highlighted

How do I create a multivalue field with an eval function?

Communicator

I need to create a multivalue field using a single eval function.

I'm using Splunk Enterprise Security and a number of the DNS dashboards rely on the field "message_type" to be populated with either "QUERY" or "RESPONSE".

In Bro DNS logs, query and response information is combined into a single event, so there is not Bro equivalent to message_type. To get around this (without having to change all the dashboards and affect other DNS data sources), I'm hoping to create a calculated field in the Bro app that will be multivalued with "QUERY" and "RESPONSE" as the values. I wanted to do something like this:

| eval messagetype = "QUERY,RESPONSE" | makemv delim="," messagetype

But the calculated fields don't seem to like piping functions, or functions that aren't eval. Any ideas?

Highlighted

Re: How do I create a multivalue field with an eval function?

SplunkTrust
SplunkTrust

@ejwade

Have you tried this?

| eval message_type = "QUERY,RESPONSE" | eval message_type=split(message_type,",")
Highlighted

Re: How do I create a multivalue field with an eval function?

Communicator

That's a great suggestion. Unfortunately, it doesn't seem like calculated fields can pipe multiple eval expressions.

Also, they don't allow chaining multiple calculated fields together - all calculated fields are processed in parallel. I need to be able to create a field with value "QUERY,RESPONSE" and then reference this as multivalue in another field (can be new, can be same).

0 Karma
Highlighted

Re: How do I create a multivalue field with an eval function?

SplunkTrust
SplunkTrust

One (chain the two eval items)

| eval message_type=split( "QUERY,RESPONSE",",")

Two (better, use mvappend)

| eval message_type=mvappend("QUERY","RESPONSE")

View solution in original post

Highlighted

Re: How do I create a multivalue field with an eval function?

Communicator

That was 100% the right approach. Thank you DalJeanis and kamlesh_vaghela for your help!

Highlighted

Re: How do I create a multivalue field with an eval function?

Path Finder

Did you add this to the CIM for DNS resolution? I tried changing the Eval Expression in the CIM, and it breaks the datamodel.

Error in 'eval' command: The arguments to the 'mvappend' function are invalid.

0 Karma
Highlighted

Re: How do I create a multivalue field with an eval function?

Path Finder

This is what I added to the CIM and it worked I missed some quotes on the mvappend:
if(index=bro,mvappend("QUERY","RESPONSE"),if(isnull(messagetype) OR messagetype="","unknown",message_type))

0 Karma
Highlighted

Re: How do I create a multivalue field with an eval function?

Communicator

bkirk - I updated the calculated field "messagetype" in props.conf instead of trying to manipulate its eval statement in the data model. The eval statement for messagetype in the data model is good as it is, because it sets the value to message_type if it exists, otherwise, "unknown"

I put this in my props:

# Match all bro_* sourcetypes.
[(?::){}bro_*]

EVAL-message_type = split("QUERY,RESPONSE",",")