Splunk Search

Splitting a multi value field in configuration files

Path Finder

I have a JSON data source in which one of the fields contains a comma separated list of values. Is there a way to use configuration files (rather than using split during the search as indicated in http://answers.splunk.com/answers/53555/splitting-a-multi-valued-field.html) to ensure that this field is extracted as a multi-value field?

Here's one example event:

{ field1=10, field2="blah,bleh,blih" }

I would like field2 to be extracted as a multi-value field with the values blah, bleh and blihwithout the need to explicitly split the value in each search.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The easiest option would to be setup a calculated field to do this splitting automatically (through configuration files) for field 2.

See this http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/definecalcfields

Anything you can do in an eval field can be done here.

View solution in original post

SplunkTrust
SplunkTrust

The easiest option would to be setup a calculated field to do this splitting automatically (through configuration files) for field 2.

See this http://docs.splunk.com/Documentation/Splunk/6.2.2/Knowledge/definecalcfields

Anything you can do in an eval field can be done here.

View solution in original post

Path Finder

This allowed me to do exactly what I needed. Thank you!

0 Karma