Field extraction into multivalue field

[Steve_Litras]

So I want to do a general field extraction of IP addresses for a sourcetype that may have them in multiple places in a given event, and may have multiples of them. Something as simple as an inline field extraction like this:

EXTRACT-mv_ip = (?\d+.\d+.\d+.\d+)

However, I'd like all occurrences to be stored in the mv_ip field as a multi value field, and I'd like to be able to use that multi value field in lookups. For some reason, I'm not understanding the documentation on field extractions enough to figure out how to do this.

Example data:

src=10.38.10.89 dst=10.188.10.50 src_port=45045 dst_port=53 src-xlated ip=10.38.12.89 port=45045 dst-xlated ip=10.188.12.50

How I'd like the mv_ip value to end up:

mv_ip = 10.38.10.89,10.188.10.50,10.38.12.89,10.188.12.50

Is this doable? If so, what am I missing?

thanks, Steve

[Ron_Naken · Accepted solution]

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

[Steve_Litras]

Thanks - worked like a charm...