Hello Splunkers.
I need help regarding a field with multiple values that must be separated.
I have the following log in the following format:
PostureReport
Policy_Umbrella;Passed
Policy_DLP;Passed
Policy_Kaspersky;Passed
Policy_Domain;Passed
Policy_SCCM;Passed
Police_Firewall_Windows;Failed
Policy_Crownstrike;Passed
I need to separate every Policy with your status.
I tried to use mvindex, mvjoin and them separate the events, mvexpand, but none of these worked for me.
Thank you.
Assuming the Police_Firewall_Windows was Policy and it is a single field in a single event, then use rex
| rex field=PostureReport max_match=0 "Policy_(?<Policy>[^;]*);(?<Status>.*)"
which will give you two multi-value fields Policy and Status.
If you want to create separate events for each policy result, then do this instead
| rex field=PostureReport max_match=0 "Policy_(?<Policy_Status>.*)"
| fields - PostureReport
| mvexpand Policy_Status
| rex field=Policy_Status "(?<Policy>[^;]*);(?<Status>.*)"
which will give you a separate event per Policy/Status pair
Assuming the Police_Firewall_Windows was Policy and it is a single field in a single event, then use rex
| rex field=PostureReport max_match=0 "Policy_(?<Policy>[^;]*);(?<Status>.*)"
which will give you two multi-value fields Policy and Status.
If you want to create separate events for each policy result, then do this instead
| rex field=PostureReport max_match=0 "Policy_(?<Policy_Status>.*)"
| fields - PostureReport
| mvexpand Policy_Status
| rex field=Policy_Status "(?<Policy>[^;]*);(?<Status>.*)"
which will give you a separate event per Policy/Status pair
The first query work perfectly. I'll try here the final query that I want.
Thank you.
Assuming each line in the log is a separate event then you can use the split function to separate the fields.
| eval policyStatus = split(PostureReport, ";")
| eval policy = mvindex(policyStatus, 0), status = mvindex(policyStatus, 1)