Splunk Enterprise Security

How to keep field names with mvaprend function?

woodentree
Communicator

Hello,

In Enterprise Security's Asset Center I'd like to create a new field called "Comment". The goal is to fill it with different information like serial number, OS, installation status, etc.

The goal is to make it looks like this:

Install Status: Preproduction
OS: Microsoft Windows Server 2019
Serial Number: ABCD1234

To keep field names I tried to use an eval function below:

| eval comment="Install Status: " . install_status  . ",OS: " . os . ",Serial Number: " . serial_number
| rex mode=sed field=comment "s/,/\n/g"

But unfortunately some of field values could be null which makes the final value of "Comment" field equal null (even if other fields are not empty). To avoid that I replaced eval with mvapprend:

| eval comment=mvappend(install_status, os, serial_number)

It helps to solve the null value issue, but now I have no idea how can I keep the field's name.

Could you please help me to find a workaround?

Thanks for the help.

0 Karma
1 Solution

to4kawa
Ultra Champion
your search
| rename another_fields as _another_fields
| foreach * [ eval comment=mvappend(comment,"<<FIELD>>",<<FIELD>>)]
| rename _another_fields as another_fields

before foreach, The rest of three fields(install_status, os, serial_number) rename _field name
and then, rename again.

View solution in original post

0 Karma

to4kawa
Ultra Champion
your search
| rename another_fields as _another_fields
| foreach * [ eval comment=mvappend(comment,"<<FIELD>>",<<FIELD>>)]
| rename _another_fields as another_fields

before foreach, The rest of three fields(install_status, os, serial_number) rename _field name
and then, rename again.

0 Karma

woodentree
Communicator

Thanks for the help @to4kawa !

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...