Splunk Search

Help with Query value in a column as per line instead of treating it as one whole value

intrach
Explorer

Hello anyone,

I need your splunk expertise. I have this lookup that is captured from a first query. Now I want my second query to search the values in “domain” column, however, you look at domain column it contains multiple values for domain and somehow when I query it, it reads it as one value instead of searching per line.

So instead of searching just:
1.fhgvfshdvcshdcsdfce6352dgcvgdcagnbdcjsagdvcwe.aski**bleep**a.com

And then

10.olskxqu287284y84fjwedwed2762391389hvhvivb87y38.aski**bleep**a.com

And then

11.qu28snmkjsamclk287284y84fjwedwed27623xcaolskx.aski**bleep**a.com

 

It instead searches for domain

“1.fhgvfshdvcshdcsdfce6352dgcvgdcagnbdcjsagdvcwe.aski**bleep**a.com 10.olskxqu287284y84fjwedwed2762391389hvhvivb87y38.aski**bleep**a.com 11.qu28snmkjsamclk287284y84fjwedwed27623xcaolskx.aski**bleep**a.com 12.njvh476xcaol4y84fjwedwed2764fncdjkasnmkjs.aski**bleep**a.com 13.caolskxqu2842fwefd9232476xcaolskscajcj47653.aski**bleep**a.com 14.jbdcwye6732hbsdjuhbjahsbayu723622gfwbfhsdbj.aski**bleep**a.com 15.2762391389hvhvivb87yqu28snmkjsamclk2.jwedwed2.aski**bleep**a.com 2.842fwefjwhbjhascajcjshbuwyrf6t376trf2gdvwqgdvqadqwscqw.gdyt326fgev.aski**bleep**a.com 3.842fwefjwhbjhascajcjsh76327dhqbd92324765364734snjvh348.qadqw.aski**bleep**a.com 4.ce6352ddcjsscajcj476536473bjhascajcjshbuwyrf6.aski**bleep**a.com 5.hgvdcywtewygcvhxcaolskxqu287284y84fncdjkasnmkjsamclk.aski**bleep**a.com 6.dcjsscajcj4vhxcaolskxqu28snmkjsamclk.aski**bleep**a.com 7.h76327dhqbd9232476xcaolskxqu2842fwefjwhbjhasc.aski**bleep**a.com 8.92324765364734snjvh476xcaolsjshdbc.lsk.aski**bleep**a.com 9.d9232476xcaolskscajcj476536473bjhaswyrf6.aski**bleep**a.com”

 

Capture_splunk.JPG

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Split the multivalue field into multiple events.

| mvexpand domain

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Split the multivalue field into multiple events.

| mvexpand domain

intrach
Explorer

Thank you so much. This fixed my problem.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...