Splunk Search

Multiple values, same field -- how?

the_wolverine
Champion

I'm not sure how to workaround an issue where my field extraction is working on multiple values of the same field. For example, I have the following event that contains lines from ldap:

(this is in one event)

memberOf: CN=tina
memberOf: CN=toby
memberOf: CN=ben

My field extraction looks like this:

(?i)memberOf: (?P<memberOf>[^\n]+) 

Splunk only pulls out the first instance of memberOf (CN=tina) and ignores the others. Is there a simple solution for this?

Tags (1)
0 Karma
1 Solution

the_wolverine
Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true

View solution in original post

0 Karma

the_wolverine
Champion

Comments doesn't allow me to format so here's my comment as a response:

How do I configure props so that it can be referenced in transforms? The following doesn't appear to work at all:

props.conf:

[ldif] 
EXTRACT-memberOf = multivalue_ldif 

transforms: [multivalue_ldif]

REGEX = (?i)memberOf: CN=(?P<memberOf>[^\,]+) 
MV_ADD = true
0 Karma

the_wolverine
Champion

w00t. Thanks Ledion and Stephen!

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

REPORT-memberOf = multivalue_ldif. The EXTRACT signifies inline regex.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I edited your source event data to match the regex. Please verify that I edited it correctly. Thanks.

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...