How to index log with table data inside?

[shayhibah]

Hi,

I have some logs that contain table data inside - which means there are multiple fields with the same key name.
Therefore, when I build my add-on and try to extract the fields using regex, Splunk refer to the 1st occurrence while the others are not index at all.

Is there any option to index the other fields with the same name as they are or by changing their name?

Example:

action = ok; action = canceled; action = ok; id = 1; id = 213; id = 98;

in that case - only the 1st occurrences of action and id will be indexed.

Thanks

[niketn]

@shayhibah, seems like you should use fields.conf with TOKENIZER

[shayhibah]

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

[somesoni2]

Basically this: https://docs.splunk.com/Documentation/Splunk/7.0.3/Knowledge/ConfigureSplunktoparsemulti-valuefields

[shayhibah]

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?