Splunk Search

Help with splitting multiline event needed

damucka
Builder

Hello,

I read my data with the inputlookup command and try to count the different occurrences of the field fields.SID as below:

 

 

 

 

| makeresults
| eval time=relative_time(now(),"-24h")
| eval time=ceil(time)
| table time
| map [ |inputlookup incidents where alert_time > $time$ ]

| join incident_id 
  [ |inputlookup incident_results ]
| fields fields.SID
| search fields.SID=*
| mvexpand fields.SID

 

 

 

 

 

Unfortunately, whatever tricks I do I am always getting several SIDs packed into a single event, see the screenshot below. 

How would I split it the way to have each fields.SID in separate row to be able to count it?

Kind Regards,

Kamil

Labels (2)
Tags (1)
0 Karma
1 Solution

damucka
Builder

I created another question where I rephrased the issue and got the solution below. Therefore i am closing this one.

https://community.splunk.com/t5/Splunk-Search/Help-with-regex-needed/m-p/571370#M199106

 

View solution in original post

0 Karma

damucka
Builder

I created another question where I rephrased the issue and got the solution below. Therefore i am closing this one.

https://community.splunk.com/t5/Splunk-Search/Help-with-regex-needed/m-p/571370#M199106

 

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!