Good morning fellow splunkers. I have a challenge and was wondering if anyone could help me. In some logs with multiple fields with the same label, we use eval mvindex to assign different label for those fields. For example, In a log, we have two fields labelled "Account Name", first one corresponding to computer account and second to user account. We use mvindex to assign labels appropriately. This works well for a known number of fields. Now, we also have logs, with groups of fields: action, module and rule:          action: quarantine          module: access          rule: verified              action: execute          module: access          rule: verified              action: continue          module: access          rule: verified                 action: reject          isFinal: true          module: pdr          rule: reject I would like to use mvindex to label those so I can use those fileds more easily. In the example above, we have four groups of those fileds, thefore I wold have: action1, action2 etc (same for module and rule). However, the number of groups changes. It could be one, two, three or more. Is there any way to use mvindex dynamically somehow? I imagine, we would have to first evaluate number of those fields (or group of fields) and then use mvindex to assign different labels? Unless there is a different way to achieve our goal. Many thnaks in advance for any advise. Kind Regards, Mike. ... View more

Good mornign All, I have several logs with fields which have sibfield. I would like to be able to extract the subfield and append it to the parent. The example should clarify my query. I have a log of user modifications. The log would look something like that: Changed Attributes:   SAM Account Name: -   Display Name: -   User Principal Name: -   Home Directory: -   Home Drive: -   Script Path: -   Profile Path: -   User Workstations: -   Password Last Set: 9/12/2023 7:30:15 AM   Account Expires: -   Primary Group ID: -   AllowedToDelegateTo: -   Old UAC Value: -   New UAC Value: -   User Account Control: -   User Parameters: -   SID History: -   Logon Hours: -   I would like to be able to create a table which will have a column which will include the "parent" field: Changed Attributes as well as the child field, for example: CHanged Attributes: Password Last Set.   Altenatively, I would also settle for a table with statically assigned column, lets call it changed data and a sa value have: Password Last Set:  9/12/2023 7:30:15 AM   Another challenge I have (probably candidate for another question on the forum) is to add the value to a table column, only if it has value other than "-" to the right of it. The reason is that only one changed attribue (of all those in the list above) will have any value. I would like to report on what attribue for a user was changed.   Thank you very much in advance for any direction.   Kind Regards,   Mike. ... View more