Splunk Search

How to create multiple files from a single file?

lenafried
New Member

I’m analyzing events that may contain one or more file names. Extracting a file name when there’s only one per event is easy. With multiple file names, only the first one is recognized. Consecutive file names are separated by a comma followed by a space. I’d like to create a separate event for each file name in the event. The number of filenames listed in an event is unknown. Events look like this:

Event A: _time, IP, user, etc. ….Added files: Filename1, Filename2, Filename3, etc.

Desired results would be:

Event A: _time, IP, user, etc. ….Added files: Filename1
Event B: _time, IP, user, etc. ….Added files: Filename2
Event C: _time, IP, user, etc. ….Added files: Filename3

I’m new and have not yet used configs/advanced features so I’m looking for a relatively straightforward solution, if possible.
Thank you.

Tags (3)
0 Karma

lenafried
New Member

Titles are separated by "," (no spaces) so I used |makemv delim=","|mvexpand Title| and it worked, for the most part.

How can I avoid creating new events due to commas that may be embedded in the Title's text, primarily dates and numbers (e.g., October 2, 2009 and 1,234,567)?

Thanks.

0 Karma

yannK
Splunk Employee
Splunk Employee

If you have an event with several time the same field, look for multivalue field extractions.
then you can decide to split events.

look at the option : multivalue in http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Managefieldtransforms

and later how to split them http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Parsemultivaluefields

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...