Multi Value Fields Extraction using Props and Transform

[shayhibah]

Hi,

I have log in the following format:

time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|

In order to extract these fields, I used both props.conf and transform.conf:

props.conf:

[my_format]
REPORT-my_format = my_format

transform.conf:

[my_format]
FORMAT = $1::$2
REGEX = ([a-zA-Z0-9_]+)=([^|]+)
MV_ADD = true

I am able to get the following fields:

time=12345678
hostname=shayh
product=blade1<>blade2<>blade3
username:sha@gmail.com

I noticed that I have an issue only with multi-value fields extraction.
multi-value fields may contains many values separated by "<>".

How can I change my settings to support current behavior with multi-value fields extraction?

UPDATE:
I succeeded to split it using fields.conf and TOKENIZER but on Splunk UI I still see it as:
product=blade1<>blade2<>blade3

Is it possible to solve it too? maybe by replacing <> with \n)?

[to4kawa]

| makeresults 
| eval _raw="time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com|" 
| kv 
| eval product=split(product,"<>")

Hi, @shayhibah

please try Fields » Calculated fields » Add new

eval expression is #4

Define calc fields

[richgalloway]

It looks like your current REGEX will work except for the 'username' field since it is not in K=V format. I would let Splunk extract the 'product' field as-is and use the split function to break it up at search time.

[shayhibah]

I need it to be done automatically using configuration files and not on the search bar itself.

[oscar84x]

If the format is field1=value1|field2=value2|... you can try:

TRANSFORMS
    [pipe_eq]
    DELIMS = "|", "="

PROPS
   [my_format]
   TRANSFORMS-delims = pipe_eq

[shayhibah]

its not working.
The current parsing is OK, I just need to support multi-value fields as well as single values.

[richgalloway]

Please share some sample data, anonymized as necessary.

[shayhibah]

@richgalloway
Hi,

Here is an example:
time=12345678|hostname=shayh|product=blade1<>blade2<>blade3|username:sha@gmail.com

Right now the pairs are perfect but I would like that field 'product' (for example) will be multi-value