Splunk Search

Multiple values, same field -- how?

the_wolverine
Champion

I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. For example, I have the following event that contains lines from ldap:

(this is in one event)

memberOf: CN=tina
memberOf: CN=toby
memberOf: CN=ben

My field extraction looks like this:

(?i)memberOf: (?P<memberOf>[^\n]+) 

Splunk only pulls out the first instance of memberOf (CN=tina) and ignores the others. Is there a simple solution for this?

Tags (1)
0 Karma
1 Solution

the_wolverine
Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true

View solution in original post

0 Karma

the_wolverine
Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true
0 Karma

the_wolverine
Champion

w00t. Thanks Ledion and Stephen!

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

REPORT-memberOf = multivalue_ldif. The EXTRACT signifies inline regex.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I edited your source event data to match the regex. Please verify that I edited it correctly. Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...