Splunk Enterprise Security

How do I create a multivalue field with an eval function?

ejwade
Communicator

I need to create a multivalue field using a single eval function.

I'm using Splunk Enterprise Security and a number of the DNS dashboards rely on the field "message_type" to be populated with either "QUERY" or "RESPONSE".

In Bro DNS logs, query and response information is combined into a single event, so there is not Bro equivalent to message_type. To get around this (without having to change all the dashboards and affect other DNS data sources), I'm hoping to create a calculated field in the Bro app that will be multivalued with "QUERY" and "RESPONSE" as the values. I wanted to do something like this:

| eval message_type = "QUERY,RESPONSE" | makemv delim="," message_type

But the calculated fields don't seem to like piping functions, or functions that aren't eval. Any ideas?

1 Solution

DalJeanis
SplunkTrust
SplunkTrust

One (chain the two eval items)

| eval message_type=split( "QUERY,RESPONSE",",")

Two (better, use mvappend)

| eval message_type=mvappend("QUERY","RESPONSE")

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

One (chain the two eval items)

| eval message_type=split( "QUERY,RESPONSE",",")

Two (better, use mvappend)

| eval message_type=mvappend("QUERY","RESPONSE")

ejwade
Communicator

That was 100% the right approach. Thank you DalJeanis and kamlesh_vaghela for your help!

bkirk
Path Finder

Did you add this to the CIM for DNS resolution? I tried changing the Eval Expression in the CIM, and it breaks the datamodel.

Error in 'eval' command: The arguments to the 'mvappend' function are invalid.

0 Karma

bkirk
Path Finder

This is what I added to the CIM and it worked I missed some quotes on the mvappend:
if(index=bro,mvappend("QUERY","RESPONSE"),if(isnull(message_type) OR message_type="","unknown",message_type))

0 Karma

ejwade
Communicator

bkirk - I updated the calculated field "message_type" in props.conf instead of trying to manipulate its eval statement in the data model. The eval statement for message_type in the data model is good as it is, because it sets the value to message_type if it exists, otherwise, "unknown"

I put this in my props:

# Match all bro_* sourcetypes.
[(?::){}bro_*]

EVAL-message_type = split("QUERY,RESPONSE",",")

kamlesh_vaghela
SplunkTrust
SplunkTrust

@ejwade

Have you tried this?

| eval message_type = "QUERY,RESPONSE" | eval message_type=split(message_type,",")

ejwade
Communicator

That's a great suggestion. Unfortunately, it doesn't seem like calculated fields can pipe multiple eval expressions.

Also, they don't allow chaining multiple calculated fields together - all calculated fields are processed in parallel. I need to be able to create a field with value "QUERY,RESPONSE" and then reference this as multivalue in another field (can be new, can be same).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...