Splunk Search

How to break out multiple key-value json fields with spath and mvexpand?

Glasses
Builder

Hi,

I am looking for a bit guidance  breaking out multi-kv pairs in json logs.

For example, I have json email logs where each email event may have multiple>>> multivalve fields, which I need separated / formatted as individual lines...

For instance a single email may have multiple attached files, and each file will have a fileName field, fileHash field, and fileExtn field.

like this in the json...

<hash1>  <fileName1>  <fileExtn1>

<hash2>  <fileName2>  <fileExtn2>

<hash3>  <fileName3>  <fileExtn3>

I want to table the each group on a separate line by subject and sender...

The issue is that I can only get 1 of the fields to break out correctly (like <hash?>) but the other fields <fileName?> and <fileExtn> are lumped together like this...

 

<hash1>      <fileName1> <fileExtn1>

                         <fileName2> <fileExtn2>

                        <fileName3> <fileExtn3>

This works for 1 field,

 

....
| spath output=hash path=foo{}.blah
| mvexpand hash
| spath input= hash
| table hash subject sender 

 

 

but I don't know how to apply this method to multiple fields and make sure the hash, fileName, fileExtn  all line up in a single formatted line with subject and sender...

 

Any help greatly appreciated, Thank you!

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@Glasses

The normal way to mvexpand on multiple fields is to use multiple mvzip commands, e.g.

| eval composite_hash=mvzip(mvzip(hash, fileName, ";"), fileExtn, ";")
| mvexpand comopsite_hash
| rex field=composite_hash "(?<hash>[^;]*);(?<fileName>[^;]*);(?<fileExtn>.*)"
| fields - composite_hash

You can either use rex at the end to recover the fields or a split+mvindex pattern, I've not tested the performance of each.

You can use this to zip up as many fields as you like. 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@Glasses

The normal way to mvexpand on multiple fields is to use multiple mvzip commands, e.g.

| eval composite_hash=mvzip(mvzip(hash, fileName, ";"), fileExtn, ";")
| mvexpand comopsite_hash
| rex field=composite_hash "(?<hash>[^;]*);(?<fileName>[^;]*);(?<fileExtn>.*)"
| fields - composite_hash

You can either use rex at the end to recover the fields or a split+mvindex pattern, I've not tested the performance of each.

You can use this to zip up as many fields as you like. 

Glasses
Builder

Thank you for the explanation, this gets me going in the right direction...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...