Splunk Search

How to index log with table data inside?

Path Finder

Hi,

I have some logs that contain table data inside - which means there are multiple fields with the same key name.
Therefore, when I build my add-on and try to extract the fields using regex, Splunk refer to the 1st occurrence while the others are not index at all.

Is there any option to index the other fields with the same name as they are or by changing their name?

Example:

action = ok; action = canceled; action = ok; id = 1; id = 213; id = 98;

in that case - only the 1st occurrences of action and id will be indexed.

Thanks

0 Karma

SplunkTrust
SplunkTrust

@shayhibah, seems like you should use fields.conf with TOKENIZER

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma

SplunkTrust
SplunkTrust
0 Karma

Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma