Splunk Search

How to index log with table data inside?

shayhibah
Path Finder

Hi,

I have some logs that contain table data inside - which means there are multiple fields with the same key name.
Therefore, when I build my add-on and try to extract the fields using regex, Splunk refer to the 1st occurrence while the others are not index at all.

Is there any option to index the other fields with the same name as they are or by changing their name?

Example:

action = ok; action = canceled; action = ok; id = 1; id = 213; id = 98;

in that case - only the 1st occurrences of action and id will be indexed.

Thanks

0 Karma

niketn
Legend

@shayhibah, seems like you should use fields.conf with TOKENIZER

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

shayhibah
Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma

somesoni2
Revered Legend
0 Karma

shayhibah
Path Finder

Unfortunately this link is relevant for search time only:

"Multivalue fields are parsed at search time, which enables you to process the resulting values in the search pipeline. "

I would like to parse them at indexing time and then index them.
Is it possible?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...