Splunk Search

How can i break multiple lines of a log ?

nettrigger
Explorer

How can i break this lines ?

I used this regex but i can't obtain multiple data of each event with lot uid:

Regex:


[ldif]
EXTRACT-ldifid = uniqueMember:\suid=(?[^\,]+)

uniqueMember: uid=b072psre,ou=people,o=b072,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ghna,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aaqu,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044mgcr,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aasa,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ogre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ggre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132mdga,ou=people,o=b132,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b830gosa,ou=People,o=B830,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132vhga,ou=People,o=B132,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp

Show all 242 lines


• host=ldif-locales

• source=OperadoresLocales.ldif

• sourcetype=ldif

• uid=b072psre

• ldifid=b072psre

I want extract the values of the consecutive rows, then i can make a top of "uid"s, Splunk only returns one "uid" for each log.

0 Karma
1 Solution

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

View solution in original post

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

nettrigger
Explorer

Thank you ! The lines is broken now ! But i don't understand why some lines is together yet.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...