How to parse multivalued field to every line?

[wvalente2]

Hello Splunkers.

I need help regarding a field with multiple values that must be separated.

I have the following log in the following format:

PostureReport
Policy_Umbrella;Passed
Policy_DLP;Passed
Policy_Kaspersky;Passed
Policy_Domain;Passed
Policy_SCCM;Passed
Police_Firewall_Windows;Failed
Policy_Crownstrike;Passed

I need to separate every Policy with your status.

I tried to use mvindex, mvjoin and them separate the events, mvexpand, but none of these worked for me.

Thank you.

[bowesmana · Accepted solution]

Assuming the Police_Firewall_Windows was Policy and it is a single field in a single event, then use rex 

| rex field=PostureReport max_match=0 "Policy_(?<Policy>[^;]*);(?<Status>.*)"

which will give you two multi-value fields Policy and Status.

If you want to create separate events for each policy result, then do this instead

| rex field=PostureReport max_match=0 "Policy_(?<Policy_Status>.*)"
| fields - PostureReport
| mvexpand Policy_Status
| rex field=Policy_Status "(?<Policy>[^;]*);(?<Status>.*)"

which will give you a separate event per Policy/Status pair

[wvalente2]

The first query work perfectly. I'll try here the final query that I want.

Thank you.

[richgalloway]

Assuming each line in the log is a separate event then you can use the split function to separate the fields.

| eval policyStatus = split(PostureReport, ";")
| eval policy = mvindex(policyStatus, 0), status = mvindex(policyStatus, 1)