Splunk Search

Multiple values, same field -- how?

Champion

I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. For example, I have the following event that contains lines from ldap:

(this is in one event)

memberOf: CN=tina
memberOf: CN=toby
memberOf: CN=ben

My field extraction looks like this:

(?i)memberOf: (?P<memberOf>[^\n]+) 

Splunk only pulls out the first instance of memberOf (CN=tina) and ignores the others. Is there a simple solution for this?

Tags (1)
0 Karma
1 Solution

Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true

View solution in original post

0 Karma

Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true

View solution in original post

0 Karma

Champion

w00t. Thanks Ledion and Stephen!

0 Karma

Splunk Employee
Splunk Employee

REPORT-memberOf = multivalue_ldif. The EXTRACT signifies inline regex.

0 Karma

Splunk Employee
Splunk Employee

I edited your source event data to match the regex. Please verify that I edited it correctly. Thanks.

0 Karma