Splunk Search

How to index log with table data inside?

shayhibah
Path Finder

Hi,

I have some logs that contain table data inside - which means there are multiple fields with the same key name.
Therefore, when I build my add-on and try to extract the fields using regex, Splunk refer to the 1st occurrence while the others are not index at all.

Is there any option to index the other fields with the same name as they are or by changing their name?

Example:

action = ok; action = canceled; action = ok; id = 1; id = 213; id = 98;

in that case - only the 1st occurrences of action and id will be indexed.

Thanks

0 Karma

niketn
Legend

@shayhibah, seems like you should use fields.conf with TOKENIZER

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

shayhibah
Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma

somesoni2
Revered Legend
0 Karma

shayhibah
Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...