×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
topher1
Engager
Member since: ‎07-10-2022
‎03-17-2025
Community Statistics
Posts 2
Solutions 1
Karma Given 0
Karma Received 1
Member Since ‎07-10-2022
Activity Feed
Topics I've Started
View All

Re: Help with Parsing multivalue fields

by in Getting Data In
‎08-24-2022 03:18 PM
1 Karma
‎08-24-2022 03:18 PM
1 Karma
Well, I actually figured it out using the split command....after I posted for help. >>Transforms.conf [multivalue_regex_field_extraction] REGEX = \\"([\w|.]+)\\":\[\\?"?([^\]]+?)\\?"?\] FORMAT = $1::$2 CLEAN_KEYS = false >>>Props.conf REPORT-regex_field_extraction = multivalue_regex_field_extraction EVAL-answers = split(answers,"\\\",\\\"") EVAL-TTLs = split(TTLs,",") Works great! ... View more

Help with Parsing multivalue fields

by in Getting Data In
‎08-18-2022 09:36 PM
‎08-18-2022 09:36 PM
Can anyone help me with extracting/parsing the multivalue fields  in sample event below using props and transforms conf. {\"ts\":1660880406.308522,\"uid\":\"CKFf5h2a9xFmkGFeFj\",\"id.orig_h\":\"10.10.10.16\",\"id.orig_p\":64179,\"id.resp_h\":\"8.8.4.4\",\"id.resp_p\":53,\"proto\":\"udp\",\"trans_id\":50808,\"rtt\":0.12951111793518067,\"query\":\"discord.com\",\"qclass\":1,\"qclass_name\":\"C_INTERNET\",\"qtype\":1,\"qtype_name\":\"A\",\"rcode\":0,\"rcode_name\":\"NOERROR\",\"AA\":false,\"TC\":false,\"RD\":true,\"RA\":true,\"Z\":0,\"answers\":[\"162.159.135.232\",\"162.159.138.232\",\"162.159.137.232\",\"162.159.136.232\",\"162.159.128.233\"],\"TTLs\":[300.0,300.0,300.0,300.0,300.0]   ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-17-2025 07:05 PM
Karma from
View All