Splunk Enterprise Security

How to create a new multivalue field based of answers field?

New Member

We have the Bro add-on installed and everything is being parsed into the proper fields. The Bro DNS logs (sourcetype=bro_dns) have a field called "answers". The value in this field can contain multiple values, all comma delimited (i.e.,, I do not have access to the backend (props.conf and transforms.conf) to make the proper changes in those files. I have tried multiple times through the UI via a Transformation field, but nothing I seem to do creates a new multivalue field (new field would be "dns_answers").

I figured this would work, but it doesn't:

Regular expression:   ( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Format:   dns_answers::$1
Source Key:   answers
Multivalue check box is checked.

What am I doing wrong?

0 Karma

Splunk Employee
Splunk Employee

Try using the split command in your searches. Something like the following:

| makeresults 
| eval commadelim="value1, value2, value3" 
| eval newmvfield=split(commadelim,",")
0 Karma

New Member

Thank you for the quick response. I understand we can do it via search, but is there no way to make it a permanent field through the UI Transformations Field page? Or can it only be made permanent by manually updating the props and transforms files?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...