Splunk Enterprise Security

How to create a new multivalue field based of answers field?

nb1030
New Member

We have the Bro add-on installed and everything is being parsed into the proper fields. The Bro DNS logs (sourcetype=bro_dns) have a field called "answers". The value in this field can contain multiple values, all comma delimited (i.e. 10.10.10.1,10.10.10.2,10.10.10.3). I do not have access to the backend (props.conf and transforms.conf) to make the proper changes in those files. I have tried multiple times through the UI via a Transformation field, but nothing I seem to do creates a new multivalue field (new field would be "dns_answers").

I figured this would work, but it doesn't:

Regular expression:   ( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Format:   dns_answers::$1
Source Key:   answers
Multivalue check box is checked.

What am I doing wrong?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Try using the split command in your searches. Something like the following:

| makeresults 
| eval commadelim="value1, value2, value3" 
| eval newmvfield=split(commadelim,",")
0 Karma

nb1030
New Member

Thank you for the quick response. I understand we can do it via search, but is there no way to make it a permanent field through the UI Transformations Field page? Or can it only be made permanent by manually updating the props and transforms files?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...