Splunk Search

How can i break multiple lines of a log ?

nettrigger
Explorer

How can i break this lines ?

I used this regex but i can't obtain multiple data of each event with lot uid:

Regex:


[ldif]
EXTRACT-ldifid = uniqueMember:\suid=(?[^\,]+)

uniqueMember: uid=b072psre,ou=people,o=b072,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ghna,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aaqu,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044mgcr,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aasa,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ogre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ggre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132mdga,ou=people,o=b132,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b830gosa,ou=People,o=B830,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132vhga,ou=People,o=B132,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp

Show all 242 lines


• host=ldif-locales

• source=OperadoresLocales.ldif

• sourcetype=ldif

• uid=b072psre

• ldifid=b072psre

I want extract the values of the consecutive rows, then i can make a top of "uid"s, Splunk only returns one "uid" for each log.

0 Karma
1 Solution

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

View solution in original post

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

nettrigger
Explorer

Thank you ! The lines is broken now ! But i don't understand why some lines is together yet.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...