Splunk Search

Field extraction into multivalue field

Steve_Litras
Path Finder

So I want to do a general field extraction of IP addresses for a sourcetype that may have them in multiple places in a given event, and may have multiples of them. Something as simple as an inline field extraction like this:

EXTRACT-mv_ip = (?\d+.\d+.\d+.\d+)

However, I'd like all occurrences to be stored in the mv_ip field as a multi value field, and I'd like to be able to use that multi value field in lookups. For some reason, I'm not understanding the documentation on field extractions enough to figure out how to do this.

Example data:

src=10.38.10.89 dst=10.188.10.50 src_port=45045 dst_port=53 src-xlated ip=10.38.12.89 port=45045 dst-xlated ip=10.188.12.50

How I'd like the mv_ip value to end up:

mv_ip = 10.38.10.89,10.188.10.50,10.38.12.89,10.188.12.50

Is this doable? If so, what am I missing?

thanks, Steve

Tags (1)
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

Steve_Litras
Path Finder

Thanks - worked like a charm...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...