Splunk Enterprise

How to Split correspondence of multi value fields

spl_stu
Explorer

Please help answer this question, thank you:

For these two multivalued fields, you want the value in the "Recipient" field to correspond to the value in the "recipient_status". If the receipt is successful, it corresponds to ";", If it fails, it corresponds to "'550 5.1.1 resolver.adr.recipnotfound, not found'". Is there a way to segment the values of these two fields and make one-to-one correspondence?

The following are the values corresponding to these two fields
Recipient="@000.com @123.com @456.com @789.com",
recipient_status=";;'550 5.1.1 RESOLVER.ADR.RecipNotFound; not found
';"

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (this assumes that the status does not have a semi-colon in)

| rex field=recipient max_match=0 "(?<rcpt>\S+)"
| rex recipient_status max_match=0 "(?i)(?<rcptstatus>(;|'550 5\.1\.1 resolver\.adr\.recipnotfound, not found'))"
| eval recipient_plus_status=mvzip(rcpt, rcptstatus)

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The recipient appears to be space delimited - how are the status values delimited?

Is what you have given as your example exactly as it is in the raw event or are these representations of the event field post extraction?

Has the data been extracted to a multi-value field (in the Splunk sense) already or are you looking for help to do that extraction?

0 Karma

spl_stu
Explorer
These two values are the log content automatically extracted by "add on". The corresponding value of "Recipient" is a field, and the corresponding value is the recipient connected by multiple space characters. The complete value of "status" is this content
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this (this assumes that the status does not have a semi-colon in)

| rex field=recipient max_match=0 "(?<rcpt>\S+)"
| rex recipient_status max_match=0 "(?i)(?<rcptstatus>(;|'550 5\.1\.1 resolver\.adr\.recipnotfound, not found'))"
| eval recipient_plus_status=mvzip(rcpt, rcptstatus)

spl_stu
Explorer


Thank you very much for your answer. My problem has been solved

0 Karma

spl_stu
Explorer
OK, thank you very much for your answer. I'll test it now
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...