Splunk Search

Multi Value Fields Extraction using Props and Transform

shayhibah
Path Finder

Hi,

I have log in the following format:

time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|

In order to extract these fields, I used both props.conf and transform.conf:

props.conf:

[my_format]
REPORT-my_format = my_format

transform.conf:

[my_format]
FORMAT = $1::$2
REGEX = ([a-zA-Z0-9_]+)=([^|]+)
MV_ADD = true

I am able to get the following fields:

time=12345678
hostname=shayh
product=blade1<>blade2<>blade3
username:sha@gmail.com

I noticed that I have an issue only with multi-value fields extraction.
multi-value fields may contains many values separated by "<>".

How can I change my settings to support current behavior with multi-value fields extraction?

UPDATE:
I succeeded to split it using fields.conf and TOKENIZER but on Splunk UI I still see it as:
product=blade1<>blade2<>blade3

Is it possible to solve it too? maybe by replacing <> with \n)?

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|" 
| kv 
| eval product=split(product,"<>")

Hi, @shayhibah

please try Fields » Calculated fields » Add new

eval expression is #4

Define calc fields

richgalloway
SplunkTrust
SplunkTrust

It looks like your current REGEX will work except for the 'username' field since it is not in K=V format. I would let Splunk extract the 'product' field as-is and use the split function to break it up at search time.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shayhibah
Path Finder

I need it to be done automatically using configuration files and not on the search bar itself.

0 Karma

oscar84x
Contributor

If the format is field1=value1|field2=value2|... you can try:

TRANSFORMS
    [pipe_eq]
    DELIMS = "|", "="

PROPS
   [my_format]
   TRANSFORMS-delims = pipe_eq
0 Karma

shayhibah
Path Finder

its not working.
The current parsing is OK, I just need to support multi-value fields as well as single values.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please share some sample data, anonymized as necessary.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shayhibah
Path Finder

@richgalloway
Hi,

Here is an example:
time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com

Right now the pairs are perfect but I would like that field 'product' (for example) will be multi-value

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...