So that I can use the textual labels as fields in Splunk see below:
I know how to register the first field extraction in the first line of above statements, but am unsure on how to add the subsequent statements to splunk so they are available to all users as fields when writing queries.
Where do I enter the makemv and mvexpand statements?
Should I use a series of subsequent transformations for the eval statements and subsequent regular expression field extractions?
How do I remove intermediate fields so users are not seeing them?
I think your best bet for getting these fields and only the fields you specifically want would be to extract them from the logs via regex in your props.conf configuration.
I suggest this because all these fields are just values directly extracted from the logs (generally speaking, if the data comes directly from the log use an extraction. Use calculated fields or lookups for enriching the data that's found directly in the logs with data that isn't)
If you can determine which app is responsible for parsing these logs, you should add the configuration to that apps props.conf should be in a directory like this:
then find the stanza for that sourcetype SOURCETYPE_NAME
and add an EXTRACT:
I included a regex that I think captures all the desired fields in the way that you want them, but I would recommend reviewing it to make sure it's right and optimizing it any way you can as I did it as a proof of concept and didn't spend any time trying to make it efficient