Splunk Search

Getting multivalued field values that are truncated by auto field extraction

Explorer

Excuse me,
I have a data like this:
index=test, product=a, category="1";"3";"6",.....

how do I set the multi fields to search "3" "6"?
thanks!

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:

    category="1"  ;"3";"6"

None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...

 index=test product=a category (3 OR 6) |  rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6

I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.

You can play with things and see what's going on, by running this search in the ui.

| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"

(the "|stats count" nonsense is just to make a dummy event with no data).

View solution in original post

Splunk Employee
Splunk Employee

None of the mv/kv stuff works because the auto field extraction code stops interpreting category's value after the 2nd quote, so it looks like this:

    category="1"  ;"3";"6"

None of the multivalue suggestions by other users will work because the 'category' field only has a value of "1". You need to pullout the values yourself. You'll need to do something like this. It's a little ugly but totally doable...

 index=test product=a category (3 OR 6) |  rex "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)" | search mvcatvals=3 OR mvcatvals=6

I'll explain. First, search for events that have a 3 or 6. Then use 'rex' pull out the string values like "1";"3";"6", into the 'catvals' field. Then use 'rex' to pull out the numbers 1,3,6 into a multivalued field, 'mvcatvals'. Finally, filter on it mvcatvals for 3 OR 6.

You can play with things and see what's going on, by running this search in the ui.

| stats count | eval fakeraw = "foo category=\"1\";\"3\";\"6\" foo" | rex field=fakeraw "category=(?<catvals>\S+)" | rex max_match=1000 field=catvals "(?<mvcatvals>\d+)"

(the "|stats count" nonsense is just to make a dummy event with no data).

View solution in original post

Explorer

Try this one:

| makemv delim=";" category | mvexpand category | search category="3" OR category="6"

0 Karma

Explorer

I have tried this, but it fail to search multi values, just show category="3" or "6"
I need to search all have 3 or 6.

0 Karma

Path Finder

Something like this might work:

| makemv delim=";" category | search category="\"3"\" category="\"6"\"

0 Karma