Splunk Search

Help with mv_add and field extractions in transforms.conf

gelica
Communicator

Hi,

I'm using props.conf and transforms.conf to extract my fields but I have some issues with MV_ADD.
My data looks like:

-----
Event1
-----
field1: number1
field2: somehing
field1: number2
-----
Event2
-----
field1: number3

It is possible that different kinds of events have the same field(field1 above) but I want to separate them, and name them like event1_field1, event2_field1.

When I use this regex, the field gets the different values:

REGEX=(?im)field1: (?<field1_value>[[^\r\n]+])
MV_ADD=true

but since I want to separate the fields I tried this, but then I only get the first value of field1..

REGEX=(?im)-{2,}[\r\n]+(Event1)[\r\n.]+-{2,}([^-]+?-?)+?field1: (?<field1_value>[[^\r\n]+])
MV_ADD=true

Can anybody please point me in the right direction?
Thanks

woodcock
Esteemed Legend

Like this:

REGEX=(?im)-{2,}[\r\n]+(Event1)[\r\n.]+-{2,}([^-]+?-?)+?field1: ([[^\r\n]+])
MV_ADD=true
FORMAT $1$2::$3
0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...