Splunk Search

Can I create a multivalue field in a search?

bfaber
Communicator

If I have data like this:

src=1.1.1.1 dst=2.2.2.2

can I create a mvfield of ip's? like:

ips=1.1.1.1,2.2.2.2

FROM SPLUNKWEB (and not the config files)?

1 Solution

Lowell
Super Champion

Yes, you can.

Try something like this

<your search> | rex max_match=2 "(?:src|dst)=(?<ips>\d+\.\d+\.\d+\.\d+)"

You can increase max_match to a higher value if you more than just 2.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

If src and dst are already fields (they would be auto-extracted by default), you could do this:

... | eval ips=src+","+dst" | eval ips=split(ips,",")

in 4.1+, or

... | eval ips=src+","+dst" | makemv ips delim=","

in earlier versions.

Lowell
Super Champion

Yes, you can.

Try something like this

<your search> | rex max_match=2 "(?:src|dst)=(?<ips>\d+\.\d+\.\d+\.\d+)"

You can increase max_match to a higher value if you more than just 2.

View solution in original post

.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!