Splunk: Extracting multiple fields with the same name

1
votes

I am using Splunk to index logs with multiple fields with the same name. All fields have the same meaning: 2012-02-22 13:10:00,ip=127.0.0.1,[email protected],[email protected]

In the automatic extraction for this event, I only get "[email protected]" extracted for the "to" field. How can I make sure all the values are extracted?

Thanks!

1
splunk

1 Answers

2
votes

I think adding this to the end of the search this may do it:

| extract pairdelim="," kvdelim="="  mv_add=t | table to

(the 'table' is just for demonstration).

So, I think, in 'transforms.conf' (from http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf) put:

[my-to-extraction]
DELIMS = ",", "="
MV_ADD = true

and reference it in 'props.conf':

[eventtype::my_custom_eventtype]
REPORT-to = my-to-extraction

where 'eventtype::my_custom_eventtype' could be anything that works as a 'props.conf' specification (<spec> in http://docs.splunk.com/Documentation/Splunk/latest/admin/propsconf).