Splunk Search

Field extraction into multivalue field

Path Finder

So I want to do a general field extraction of IP addresses for a sourcetype that may have them in multiple places in a given event, and may have multiples of them. Something as simple as an inline field extraction like this:

EXTRACT-mv_ip = (?\d+.\d+.\d+.\d+)

However, I'd like all occurrences to be stored in the mv_ip field as a multi value field, and I'd like to be able to use that multi value field in lookups. For some reason, I'm not understanding the documentation on field extractions enough to figure out how to do this.

Example data:

src=10.38.10.89 dst=10.188.10.50 src_port=45045 dst_port=53 src-xlated ip=10.38.12.89 port=45045 dst-xlated ip=10.188.12.50

How I'd like the mv_ip value to end up:

mv_ip = 10.38.10.89,10.188.10.50,10.38.12.89,10.188.12.50

Is this doable? If so, what am I missing?

thanks, Steve

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

View solution in original post

Splunk Employee
Splunk Employee

If you want multiple values for a single field, you need to use MV_ADD.

PROPS.CONF:

[mysourcetype]
REPORT-mv_ip = xf-mvips

TRANSFORMS.CONF:

[xf-mvips]
REGEX = (?<mv_ip>\d+\.\d+\.\d+\.\d+)
MV_ADD = true

View solution in original post

Path Finder

Thanks - worked like a charm...

0 Karma