Splunk Search

Multivalue field extraction

cdstealer
Contributor

Hi, I'm struggling to get this extracted correctly so it's usable.
The raw data is presented as:

    Privileges: SeSecurityPrivilege
            SeBackupPrivilege
            SeRestorePrivilege
            SeTakeOwnershipPrivilege
            SeDebugPrivilege
            SeSystemEnvironmentPrivilege
            SeLoadDriverPrivilege
            SeImpersonatePrivilege
            SeAssignPrimaryTokenPrivilege

By default, only the first entry is assigned to the field eg:

"SeSecurityPrivilege"

I can extract the remaining lines into the field using the regex "Privileges:\t(?P(\w+\s+|\t\t\t\w+\s+)+)", which returns this:

"SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege"

Now what I need is to split each of these into the Privileges field as separate values.

These values are not a static number of entries, so Privileges could contain anything between 1 and 10 lines.

Any advice would be great as the docs and answers I've read don't seem to help this situation.

TIA
Steve

1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=main EventCode="576" |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)" | rex field=Privileges max_match=0 "(?<Privilege>\S+)\s+" | mvexpand Privilege

View solution in original post

cdstealer
Contributor

Thanks to everyone that has offered help. Much appreciated.

0 Karma

alemarzu
Motivator

Hi cdstealer

Try to add this, after your field extraction.

main search | rex field=_raw ... | makemv delim=" " Privileges | mvexpand Privileges 

Hope it helps.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=main EventCode="576" |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)" | rex field=Privileges max_match=0 "(?<Privilege>\S+)\s+" | mvexpand Privilege

cdstealer
Contributor

Perfect! I think you've solved a couple of my past questions. So thank you very much again 🙂

0 Karma

cdstealer
Contributor

Hi again, Now I'm struggling transferring the search into props/transforms. I'm probably missing something simple.

props.conf:

EXTRACT-Privileges = Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)
REPORT-fields = privilege

transforms.conf:

[privilege]
SOURCE_KEY = Privileges
REGEX = "(?<privilege>\S+)\s+)
REPEAT_MATCH = true
MV_ADD = true

So the new field that contains the extracted values is not happening.

0 Karma

DavidHourani
Super Champion

Hello, did you manage to solve this ?

0 Karma

skawasaki_splun
Splunk Employee
Splunk Employee

You have an extra " in front of your REGEX in transforms.conf.

0 Karma

fdi01
Motivator

try :

  your_base_search|rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"| eval Privileges=split(field_name_extraction, " ")| mvexpand Privileges|...
0 Karma

cdstealer
Contributor

Hi fdi01, Thanks. Unfortunately this does not change the output.

Steve

0 Karma

fdi01
Motivator

your rex |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"| capture all results in Privileges field ???

0 Karma

cdstealer
Contributor

This is what I'm getting.
alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...