Splunk Enterprise Security

How to move multivalue fields as separate columns?

fedejko
Explorer

Hi, I have the following case which I can't get around.

My search returns something like this:

fedejko_1-1653388455827.png

In order to help security analysts with some useful information, from a lookup we are adding MITRE technique ID  and some useful information about how to detect this particular technique.

What I wanted to do is to move the multivalue fields from mitre_technique_id column as the separate columns named exactly like the MITRE ID, and in that column I wanted to include the information about the detection tips for that technique.

I was trying something with foreach, transpose, mvexpand but with no good results.

Does anyone knows how to achieve it? The end result would look like this:

fedejko_2-1653388970492.png

Thanks in advance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

View solution in original post

somesoni2
Revered Legend

Give this a try

YOur current search giving field host, dest, user, mitre_technique_id mitre_detection
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<mitre_technique_id>[^\|]+)\|(?<mitre_detection>.+)"
| fields - iddetect
| eval common_key=host."##".dest."##".user
| xyseries common_key mitre_technique_id mitre_detection
| rex field=common_key "(?<host>[^#]+)##(?<dest>.+)##(?<user>.+)"
| fields - common_key
| table host dest user *
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| streamstats count as row 
| eval iddetect=mvzip(mitre_technique_id,mitre_detection,"|")
| mvexpand iddetect
| rex field=iddetect "(?<_name>[^\|]+)\|(?<_value>.+)"
| eval {_name}=_value
| fields - iddetect mitre_technique_id mitre_detection
| stats values(*) as * by row
| fields - row

fedejko
Explorer

Solved by adding (?s) in front of the regex.

0 Karma

fedejko
Explorer

Thanks, I see the light in the tunnel 🙂

How to modify that regex so it captures remaining lines of the paragraph?

fedejko_1-1653397241943.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| rex field=iddetect "(?ms)(?<_name>[^\|]+)\|(?<_value>.+)"
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...