Splunk Search

Is it possible to event break from a single field?

rpraveena03
New Member

I do have a multivalue field with the letters cls and tenant at the end of it. Is it possible to break the data into different rows.

Screenshot 2023-05-02 at 4.59.28 PM.png

Labels (1)
0 Karma

rpraveena03
New Member

This log is already ingested into Splunk using custom command by the application team. Now I can't go back with props configuration. 

Is there any way to achieve through query from UI

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Unfortunately, poorly-onboarded data stays that way forever.  That's why it's important to test the onboarding process before accepting new data.  I hope you've had a chat with the application team about that.

There is the split SPL function that can be used in conjunction with mvexpand to break a field into multiple events.  That function separates the field based on a single character rather than a string so it won't work in this case.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try putting this in one of your props.conf files

[mysourcetype]
LINE_BREAKER = ()\{"_cls
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...