Splunk Search

How to extract multivalue data to dynamic fields?

jmartens
Path Finder

I am trying to extract multi value fields and set dynamic fields with values based on the extracted data. I am able to extract the data but am unable to do the last part and generate dynamic fields, only the first is generated:

 

 

| makeresults 
| eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]"
| eval temp=split(DICOMQuery,"|") 
| rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]"
| eval {DICOMLabel}=DICOMValue
| fields - DICOMQuery DICOMLabel, DICOMValue temp

 

 

Which yields the following:

jmartens_0-1686563048323.png

It seems I am nearly there, but I fail to get them as individual searchable fields which is what I am after. Any pointers?

0 Karma
1 Solution

jmartens
Path Finder

After some more searching I stumbled on mvexpand and had to add it to expand the temp field like this:

| makeresults 
| eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]"
| eval temp=split(DICOMQuery,"|") 
| mvexpand temp
| rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]"
| eval {DICOMLabel}=DICOMValue
| fields - DICOMQuery DICOMLabel, DICOMValue temp

View solution in original post

0 Karma

jmartens
Path Finder

After some more searching I stumbled on mvexpand and had to add it to expand the temp field like this:

| makeresults 
| eval DICOMQuery="(0008,0052) Query/Retrieve Level [SERIES] | (0010,0020) Patient ID [1234567] | (0020,000D) Study Instance UID [1.2.34.567890.12.3456.789.123456.7.20230501130047.4915859] | (0020,000E) Series Instance UID [1.2.345.678.90.1.23456789012.34567890.20230508110959]"
| eval temp=split(DICOMQuery,"|") 
| mvexpand temp
| rex field=temp "(?<DICOMGroup>([\dA-Fa-f]{4})),\d?(?<DICOMElement>([\dA-Fa-f]{4}))\)\s+(?<DICOMLabel>[^\[]+)\s\[(?<DICOMValue>[^\]]+)\]"
| eval {DICOMLabel}=DICOMValue
| fields - DICOMQuery DICOMLabel, DICOMValue temp
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...