Splunk Search

Help with Eval from Multivalue field?

ff170a
Explorer

I have a dataset with a multiline field called Logs. The field typically has values like the below,

 

 

  "mId": "Null",
  "deviceID": "a398Z389j",
  "cSession": "443",
  "cWeb": "443",
  "uWeb": "Mixed",
  "s": "Steak",
  "Ing": [
    "1-555-5555555",
    "1-888-8888888"
  ],
  "Sem": [
    "Warehouse@Forest.box"
  ]

 

 

I'd like to make it so I can identify the values within "Ing" and easily search where a specific value is in "Ing" for other events. I was able to break it out and split on the comma and then look at the index number 6 but this only returns the 1st item, where in most events there are multiple (upwards of 10) items.

 

| eval a = mvindex(split(Logs,","), 6)

  "Ing": [
    "1-555-5555555"

 


Thoughts on how to get a complete list of the items in Ing?


Labels (1)
0 Karma
1 Solution

johnhuang
Motivator

Assuming  that Ing values are always formatted as a phone number:

| rex field=Logs "\"(?<ing_values>\d\-\d{3}\-\d+)\""
| eval ing_6=MVINDEX(ing_values, 6)

 

View solution in original post

0 Karma

johnhuang
Motivator

Assuming  that Ing values are always formatted as a phone number:

| rex field=Logs "\"(?<ing_values>\d\-\d{3}\-\d+)\""
| eval ing_6=MVINDEX(ing_values, 6)

 

0 Karma

ff170a
Explorer

Thanks for the response. The numbers do appear in a phone number format, but are not phone numbers.

If I use that rex on my data, I only get the first item in the ing field, and not all of the items, which is what I am trying to gather.

0 Karma

ff170a
Explorer

Adding a max_match=10 resolved that issue. Looks like I got what I need. Thanks!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...