Splunk Search
Highlighted

Field extraction on post multikv field?

Splunk Employee
Splunk Employee

Is it possible to create a field extraction on a field that only exists after piping through multikv?

In other words, can I persist this:

index="os" sourcetype="netstat" | multikv | rex field=LocalAddress "(?<port>\d{5})$"
Tags (1)
0 Karma
Highlighted

Re: Field extraction on post multikv field?

Splunk Employee
Splunk Employee

No, Splunk will not extract fields that are only present post multikv. This extraction will need to be based on the _raw field.

View solution in original post

0 Karma
Highlighted

Re: Field extraction on post multikv field?

Splunk Employee
Splunk Employee

Well, to clarify, it will do almost just as you've set up above (though you're missing a field name for the extraction), it just can't be set up as an automatic extraction.

0 Karma
Highlighted

Re: Field extraction on post multikv field?

Splunk Employee
Splunk Employee

okay, i just edited it and saw the tag was htmlized away. so that should work as is. just can't make it auto whatever.

0 Karma