How can i break multiple lines of a log ?

[nettrigger]

How can i break this lines ?

I used this regex but i can't obtain multiple data of each event with lot uid:

Regex:


[ldif]
EXTRACT-ldifid = uniqueMember:\suid=(?[^\,]+)

uniqueMember: uid=b072psre,ou=people,o=b072,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ghna,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aaqu,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044mgcr,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044aasa,ou=People,o=B044,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ogre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b044ggre,ou=people,o=b044,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132mdga,ou=people,o=b132,o=nacionales,o=bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b830gosa,ou=People,o=B830,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp
uniqueMember: uid=b132vhga,ou=People,o=B132,o=Nacionales,o=Bancos,o=clientes,o=prosa.com.mx,o=isp

Show all 242 lines


• host=ldif-locales

• source=OperadoresLocales.ldif

• sourcetype=ldif

• uid=b072psre

• ldifid=b072psre

I want extract the values of the consecutive rows, then i can make a top of "uid"s, Splunk only returns one "uid" for each log.

[Ayn · Accepted solution]

You need to add the directive MV_ADD = true in props.conf. By default Splunk will just extract one value and then stop - but if you specify MV_ADD = true it will continue matching and create a multivalued field holding all values.

[nettrigger]

Thank you ! The lines is broken now ! But i don't understand why some lines is together yet.