Splunk Search

normalising duplicate multivalue field

ytl
Path Finder

so i have numerous field extractions in place. unfortunately due to the number of regex's there are some events that match two field extractions. the issue is that i have the same field name defined in both extractions.

this isn't a problem as splunk is nice enough to create a multivalue field for me automatically. it just so happens that the value of that field is the same for both entries!

is there a way i can reduce/normalise this so it doesn't show twice? (without reconstructing my regex's)

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There really isn't an easy way globally.

In general, you might look at:

  • Using app namespaces to control when particular extractions are performed. If some are only needed in certain contexts, then perhaps these contexts could be separated out into their own app to avoid this kind of conflict
  • Making the regexes more precise and/or combining multiple regexes into a single one that retrieves multiple fields

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

There really isn't an easy way globally.

In general, you might look at:

  • Using app namespaces to control when particular extractions are performed. If some are only needed in certain contexts, then perhaps these contexts could be separated out into their own app to avoid this kind of conflict
  • Making the regexes more precise and/or combining multiple regexes into a single one that retrieves multiple fields
0 Karma

ytl
Path Finder

oh well... back to restructuring my regex's i guess... just a thought, when i do a top on such a field - would it double count? cheers,

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...