Splunk Search
Highlighted

Can I create a multivalue field in a search?

Communicator

If I have data like this:

src=1.1.1.1 dst=2.2.2.2

can I create a mvfield of ip's? like:

ips=1.1.1.1,2.2.2.2

FROM SPLUNKWEB (and not the config files)?

Highlighted

Re: Can I create a multivalue field in a search?

Super Champion

Yes, you can.

Try something like this

<your search> | rex max_match=2 "(?:src|dst)=(?<ips>\d+\.\d+\.\d+\.\d+)"

You can increase max_match to a higher value if you more than just 2.

View solution in original post

Highlighted

Re: Can I create a multivalue field in a search?

Splunk Employee
Splunk Employee

If src and dst are already fields (they would be auto-extracted by default), you could do this:

... | eval ips=src+","+dst" | eval ips=split(ips,",")

in 4.1+, or

... | eval ips=src+","+dst" | makemv ips delim=","

in earlier versions.