Splunk Search

Multiple values per key in one record

blurblebot
Communicator

If I have records with multiple k/v pairs with the same keyname, can I parse that through Splunk search language or by massaging the confs so that each k/v pair is reflected in the results of searches against it?

For instance, assuming these records are alone in their index:

3/30/2011 04:53:22 index=Org_Personnel Name=Herbert Name=Yancey Name=Bartleby Department=Acquisitions 

3/30/2011 04:53:22 index=Org_Personnel Name=Carol Name=Cyril Name=Lana Name=Mallory Department=IT

(the second line is to illustrate that number of kv pairs can vary from one record to the next)

Now my simple search:

index=Org_Personnel |stats count(name)

How would I make that return "7" instead of "2" as it would without modification?

Thank you in advance.

-s

1 Solution

hazekamp
Builder

Blurblebot,

You can do this via props/transforms like so. The trick is to use MV_ADD http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf:

## props.conf
[<your_sourcetype>]
REPORT-name_for_your_sourcetype = name_for_your_sourcetype

## transforms.conf
[name_for_your_sourcetype]
REGEX = Name=(\S+)
FORMAT = name::$1
MV_ADD = True

View solution in original post

hazekamp
Builder

Blurblebot,

You can do this via props/transforms like so. The trick is to use MV_ADD http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf:

## props.conf
[<your_sourcetype>]
REPORT-name_for_your_sourcetype = name_for_your_sourcetype

## transforms.conf
[name_for_your_sourcetype]
REGEX = Name=(\S+)
FORMAT = name::$1
MV_ADD = True

blurblebot
Communicator

Small capitalization correction on your answer:

FORMAT = Name::$1

blurblebot
Communicator

Beauty. Thanks!

ftk
Motivator

You beat me to it!

0 Karma

blurblebot
Communicator

Sorry about the last title. That was bad form.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...