Splunk Search

Help with Logic when a multivalue field appears: How to utilise lookup?


I have some events coming in that use a lookup to resolve to an action eg :

Block,block,not sent = blocked

tagged, delivered, logged = delivered

Occasionally a multivalue field appears such as :






the Logic should be : 

Tagged Logged = delivered

Tagged Block = Block

Trying to figure out how to add this logic to utilise the lookup.

Played around with nomv which creates a single value field but adds a \n so the value becomes :  Tagged\nLogged

But then i need to do do a sedcmd to remove the \n and then add the result to the lookup to resolve the desired action.

Is there a better approach in this scenario ? 



Labels (2)
Tags (2)
0 Karma


Hi @Esky73,

the action you are describing is called normalization and it's usually done to normalize logs to CIM compliance.

At first I hint to see if there's an Add-on that already made normalization for your logs, if there isn't I hint to use calculated fields, e.g. something like this:

| eval action=case(action="Block","blocked",action="block","blocked",action="not sent","blocked",action="tagged","delivered", action="delivered","delivered", action="logged","delivered")

About the multivalue, see if it's possible to extract fields in a different way or use "like" in the above condition.



0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...