Multivalue fields extraction

[rukshar]

Hi,

Please help me in extracting multivalue fields from email body logs:

LOG:

"Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1" "XXXX.emea.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows" "XXXX.na.intra","ACN - Windows Server - PL - Up to Oct24","Compliant","[ACN - Windows Server - PL - Up to Aug24] + [ACN - Windows Server - PL - Sep24]","Compliant","Windows"

Fields i want to extract are these: "Computer Name","Patch List Name","Compliance Status","Patch List Name1","Compliance Status1","OS Type1"

I have applied rex to bring out all the fields 

The rex is giving me total number of 3131 computer_names but when i am using mvexpand command to expand in into multiple rows , it is giving me only 1500 results not sure why rest are getting truncated.

Attaching the search query and snippet for reference:

index=mail "*tanium*"
|spath=body
|rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN"
|rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n"
|rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n"
|eval Computer_name=mvappend(Computer_name,Computer_name2)|table Computer_name
|dedup Computer_name
| mvexpand Computer_name
| makemv Computer_name delim=","

index=mail "*tanium*"
|spath=body
|rex field=body max_match=0 "\"(?<Computer_name>.*)\",\"ACN"
|rex field=body max_match=0 "\"(?<Computer_name1>.*)\",\"\[n"
|rex field=Computer_name1 max_match=0 "(?<Computer_name2>.*)\",\"\[n"
|eval Computer_name=mvappend(Computer_name,Computer_name2)
|rex field=body max_match=0 "\,(?<Patch_List_Name1>.*)\"\["
|rex field=Patch_List_Name1 max_match=0 "\"(?<Patch_List_Name>.*)\",\""
|rex field=Patch_List_Name1 max_match=0 "\",\""(?<Compliance_status>.*)\"
|table Computer_name Patch_List_Name Compliance_status
|dedup Computer_name Patch_List_Name Compliance_status
| eval tagged=mvzip(Computer_name,Patch_List_Name)
| eval tagged=mvzip(tagged,Compliance_status)
| mvexpand tagged
| makemv tagged delim=","
| eval Computer_name=mvindex(tagged,0)
| eval Patch_List_Name=mvindex(tagged,1)
|eval Compliance_status=mvindex(tagged,-1)
|table Computer_name Patch_List_Name Compliance_status

[PickleRick]

1. This is not your whole event since you're doing spath to get it.

2. Don't search for "*tanium*". Wildcards at the beginning of search term will make Splunk read all raw events.

3. We don't know your data. How can we know why your results are "wrong"? Maybe some of your extractions don't work and you get nulls. Dedups or mvzips on them will yield null results.

4. There are two typical ways of debugging SPL searches. One is to start from the start and add commands until their results stop making sense. Another is to start from the end and remove commands untill the results start making sense.