Implementing Splunk 7 - Third Edition

Creating multivalue fields

Assuming some value might occur multiple times in a given event, an EXTRACT definition can only match the first occurrence. For example, say we have the event:

2012-08-25T20:18:09 action=send [e-mail] [e-mail] [e-mail] 

We could pull the first email address using the following extraction:

EXTRACT-email = (?i)(?P<email>[a-zA-Z0-9._]+@[a-zA-Z0-9._]+) 

This would set the field email to [e-mail]. Using a REPORT attribute and the transform stanza, we can capture all of the email addresses using the MV_ADD attribute. The props stanza would look like this:

REPORT-mvemail = mvemail 

The transforms.conf stanza would then look like this:

[mvemail] 
REGEX = (?i)([a-zA-Z0-9._]+@[a-zA-Z0-9._]+) 
FORMAT = email::$1 
MV_ADD = true