Splunk Search

Help with Logic when a multivalue field appears: How to utilise lookup?


I have some events coming in that use a lookup to resolve to an action eg :

Block,block,not sent = blocked

tagged, delivered, logged = delivered

Occasionally a multivalue field appears such as :






the Logic should be : 

Tagged Logged = delivered

Tagged Block = Block

Trying to figure out how to add this logic to utilise the lookup.

Played around with nomv which creates a single value field but adds a \n so the value becomes :  Tagged\nLogged

But then i need to do do a sedcmd to remove the \n and then add the result to the lookup to resolve the desired action.

Is there a better approach in this scenario ? 



Labels (2)
Tags (2)
0 Karma


Hi @Esky73,

the action you are describing is called normalization and it's usually done to normalize logs to CIM compliance.

At first I hint to see if there's an Add-on that already made normalization for your logs, if there isn't I hint to use calculated fields, e.g. something like this:

| eval action=case(action="Block","blocked",action="block","blocked",action="not sent","blocked",action="tagged","delivered", action="delivered","delivered", action="logged","delivered")

About the multivalue, see if it's possible to extract fields in a different way or use "like" in the above condition.



0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...