Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Multivalue field extraction

$
0
0
Hi, I'm struggling to get this extracted correctly so it's usable. The raw data is presented as: Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege SeAssignPrimaryTokenPrivilege By default, only the first entry is assigned to the field eg: "**SeSecurityPrivilege**" I can extract the remaining lines into the field using the regex "Privileges:\t(?P(\w+\s+|\t\t\t\w+\s+)+)", which returns this: "**SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege**" Now what I need is to split each of these into the Privileges field as separate values. These values are not a static number of entries, so Privileges could contain anything between 1 and 10 lines. Any advice would be great as the docs and answers I've read don't seem to help this situation. TIA Steve

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>