Splunk Search

Extracting multiple field values with same field name

splunkingsplun1
Explorer

Can anyone provide assistance for extracting multiple field values with same field name? My log is something like this:

10:10:34 scan_date="2014-05-24 10:10:34" ip=192.168.1.1 port=445 protocol=tcp results="- NULL sessions are enabled on the remote host " cve=CVE-1999-0503 cve=CVE-1999-0504 cve=CVE-1999-0505 cve=CVE-1999-0506 cve=CVE-2000-0222 cve=CVE-2002-1117 mskb=Q132679 mskb=Q143474 mskb=Q289655

As you can observe I have multiple CVE and MSKB values and Splunk stops after extracting first value. I would like to extract all of them. Any suggestions? Any input would be helpful.

0 Karma

MuS
Legend

Hi splunkingsplunker,

have you tried adding MV_ADD in transforms.conf for that sourcetype?

MV_ADD = [true|false]
* NOTE: This attribute is only valid for search-time field extractions.
* Optional. Controls what the extractor does when it finds a field which already exists.
* If set to true, the extractor makes the field a multivalued field and appends the 
* newly found value, otherwise the newly found value is discarded.
* Defaults to false

hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...