topic Re: how to get many values for a particular field (ex) product_id.. in Getting Data In

how to get many values for a particular field (ex) product_id..

dilstn — Mon, 28 Sep 2020 13:32:07 GMT

If I use the regex for extracting product_id from this log it picks only one value of product_id
this is the regex i use "(?i)\"product_id\"=>\"(?P[^\"]+)"
but it gives value for product_id is "Bookflix - Latin America Bilingual "
but i cant get other product_id values from this single log ..........can u guide me....

Log 23/11/7 :: info parameter [{"product_id"=>"Bookflix - Latin America Bilingual ", "subscription_start"=>"November 22, 2012", "subscription_end"=>"April 11, 2013", "intl_order_type_code"=>"Trial "}, {"product_id"=>"TrueFlix - Latin America ", "subscription_start"=>"November 22, 2012", "subscription_end"=>"April 11, 2013", "intl_order_type_code"=>"Trial "}, {"product_id"=>"The Graph Club ", "subscription_start"=>"November 22, 2012", "subscription_end"=>"April 11, 2013", "intl_order_type_code"=>"Trial "}, {"product_id"=>"Neighborhood Map Machine ", "subscription_start"=>"November 22, 2012", "subscription_end"=>"April 11, 2013", "intl_order_type_code"=>"Trial "}, {"product_id"=>"Timeliner ", "subscription_start"=>"November 22, 2012", "subscription_end"=>"April 11, 2013", "intl_order_type_code"=>"Trial "}

Re: how to get many values for a particular field (ex) product_id..

Ayn — Mon, 18 Mar 2013 07:45:59 GMT

How are you extracting it? rex, entry in props.conf? The default behaviour is to only extract one value but that can easily be changed.

Re: how to get many values for a particular field (ex) product_id..

dilstn — Mon, 18 Mar 2013 07:58:04 GMT

only through rex i want to extract it

Re: how to get many values for a particular field (ex) product_id..

Ayn — Mon, 18 Mar 2013 08:07:17 GMT

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Rex

max_match
    Syntax: max_match=<int> 
    Description: Controls the number of times the regex is matched. If greater than 1, the resulting fields will be multivalued fields. Defaults to 1, use 0 to mean unlimited.

Re: how to get many values for a particular field (ex) product_id..

dilstn — Mon, 28 Sep 2020 13:32:12 GMT

rex "(?i)\"product_id\"=>\"(?P[^\"]+)" max_match=0

This is not working ....please give me an example for this to work properly ....thanks in advance ....plzzzzz.

Re: how to get many values for a particular field (ex) product_id..

dilstn — Mon, 28 Sep 2020 13:32:16 GMT

rex "(?i)\"product_id\"=>\"(?P[^\"]+)"max_match=0
This is not working... please give me an example for this to work properly... thanks in advance..plzzzzzzz

Re: how to get many values for a particular field (ex) product_id..

Ayn — Mon, 18 Mar 2013 09:25:52 GMT

Which Splunk version? What are the current results?

Re: how to get many values for a particular field (ex) product_id..

dilstn — Mon, 18 Mar 2013 09:30:26 GMT

Sorry guys it works ....i made mistake to provide value in max_match=10 ..........Thanks for ur help

Re: how to get many values for a particular field (ex) product_id..

dilstn — Mon, 18 Mar 2013 09:31:13 GMT

Sorry yaar , it works ,, I made a mistake that by not providing value to max_match=10...thanks for ur kind help....

Re: how to get many values for a particular field (ex) product_id..

Ayn — Mon, 18 Mar 2013 09:33:33 GMT

No problem. Could you please mark my answer as accepted (click the tick mark beside it)? Thanks!