Splunk Search

How can i break multiple lines of a log ?

nettrigger
Explorer

How can i break this lines ?

I used this regex but i can't obtain multiple data of each event with lot uid:

Regex:


[ldif]
EXTRACT-ldifid = uniqueMember:\suid=(?[^\,]+)

uniqueMember: uid=b072psre,ou=people,o=b072,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ghna,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aaqu,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044mgcr,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aasa,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ogre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ggre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132mdga,ou=people,o=b132,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b830gosa,ou=People,o=B830,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132vhga,ou=People,o=B132,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp

Show all 242 lines


• host=ldif-locales

• source=OperadoresLocales.ldif

• sourcetype=ldif

• uid=b072psre

• ldifid=b072psre

I want extract the values of the consecutive rows, then i can make a top of "uid"s, Splunk only returns one "uid" for each log.

0 Karma
1 Solution

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

View solution in original post

Ayn
Legend

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

nettrigger
Explorer

Thank you ! The lines is broken now ! But i don't understand why some lines is together yet.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...