Splunk Search

How to create multivalue field with regex?

Path Finder

Hello

I want to push values into a multivalue field.

The raw data are looking like the following:

Sep 6 14:27:56 This is a test from admin@chip.de toaddress: test1@chip.de, test2@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to
address: test1@chip.de
Sep 7 12:24:34 This is a test from admin@chip.de to_address: test1@chip.de, test2@chip.de, test3@chip.de, info@web.com

Now I want to push all email addresses after the to_address into a multivalue field.

Does anyone know, how to achieve this?

Thanks

0 Karma

Path Finder

Hello,
in order to have a multivalue field from the regex, make sure to tweak the fields.conf as well:

TOKENIZER =
Use this setting to configure multivalue fields. A regular expression that indicates how the field can take on multiple values
at the same time. Otherwise, the first group is taken from each match to form the set of
values.

More info in the docs: fields.conf spec

Hope it helps, regards..

0 Karma

Legend

Try this

... | rex "to_address\:\s(?<to>.*)" | makemv to delim=", "