Splunk Search

Extracting multiple values from single unstructured event

dkgs
Communicator

Hi,

In a single event, we have a field named username which is occurring multiple time in the events in raw data and username are different. How can we extract this username field since there are multiple values in the same event. Please help, this is the SAP spool data which is forwarded to splunk cloud. Attaching the screensho with mutiple usernames in single event

dkgs_0-1598601699362.png

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you need something like

...
| rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s"
| mvexpand user

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you need something like

...
| rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s"
| mvexpand user

dkgs
Communicator

 @ITWhisperer Thank you , the expression is working fine in search.

When I am trying to give the same expression while extracting fields, so that the field user will be permanent, Its not working. I had chosen 'I prefer to write the regular expression myself '   and had added the expression. But I am not able to view the field.Could you please suggest whats causing the issue, but the same is working in search.

Attaching screenshot for reference. Please suggest if its the same way we have to give regular expression while extracting fields

 
 
 
 
 
 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @dkgs 

You can only provide the expression 

LINE\":\"\|(?<user>[^\s]*)\s

Unfortunately, I can't see a way of providing the max_match=0 part so you will only be able to extract the first match.

To get all the instances in a multivalue field on a more permanent basis, you may have to adopt the transforms and props configuration approach 

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...