Splunk Search

Extracting multiple values from single unstructured event

dkgs
Communicator

Hi,

In a single event, we have a field named username which is occurring multiple time in the events in raw data and username are different. How can we extract this username field since there are multiple values in the same event. Please help, this is the SAP spool data which is forwarded to splunk cloud. Attaching the screensho with mutiple usernames in single event

dkgs_0-1598601699362.png

 

Labels (5)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you need something like

...
| rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s"
| mvexpand user

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Looks like you need something like

...
| rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s"
| mvexpand user

dkgs
Communicator

 @ITWhisperer Thank you , the expression is working fine in search.

When I am trying to give the same expression while extracting fields, so that the field user will be permanent, Its not working. I had chosen 'I prefer to write the regular expression myself '   and had added the expression. But I am not able to view the field.Could you please suggest whats causing the issue, but the same is working in search.

Attaching screenshot for reference. Please suggest if its the same way we have to give regular expression while extracting fields

 
 
 
 
 
 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Hi @dkgs 

You can only provide the expression 

LINE\":\"\|(?<user>[^\s]*)\s

Unfortunately, I can't see a way of providing the max_match=0 part so you will only be able to extract the first match.

To get all the instances in a multivalue field on a more permanent basis, you may have to adopt the transforms and props configuration approach 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...