topic Re: How to extract all matching values from an event using regex in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44439#M10481 <P>Thanks Ayn,Its working fine..........</P> Mon, 07 May 2012 04:37:18 GMT john 2012-05-07T04:37:18Z How to extract all matching values from an event using regex https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44437#M10479 <P>Hi,</P> <P>iam trying to extract certain values from my log files which i have given below<BR /> 1st event<BR /> at x.x.x.x.x.x(1)<BR /> at x.x.x.x.x.x.x.x(2)<BR /> at X.x.x.x.x.x.x.x.xx(3)<BR /> ...........<BR /> 2nd event<BR /> at x.x.x.x.x.x(4)<BR /> at x.x.x.x.x.x.x.x(5)<BR /> at X.x.x.x.x.x.x.x.xx(6)<BR /> ...............<BR /> .........<BR /> The issue iam facing is iam getting only first line of every event starting with "at", not the all lines in one event itself.I want all the values after "at" in each events"<BR /> the output iam getting is like this</P> <P>x.x.x.x.x.x(1)<BR /> x.x.x.x.x.x.x.x(5)</P> <P>This is the regex iam using </P> <P>rex field=_raw "at\s(?<VALUE>.*)\s"</VALUE></P> Sat, 05 May 2012 10:39:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44437#M10479 john 2012-05-05T10:39:00Z Re: How to extract all matching values from an event using regex https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44438#M10480 <P><CODE>rex</CODE> only matches one time by default. This behaviour is controlled by the <CODE>max_match</CODE> parameter, so if you want more matches just set it to something higher:</P> <PRE><CODE>... | rex max_match=10 field=_raw "at\s(?&lt;value&gt;.*?)\s" </CODE></PRE> Sat, 05 May 2012 10:51:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44438#M10480 Ayn 2012-05-05T10:51:27Z Re: How to extract all matching values from an event using regex https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44439#M10481 <P>Thanks Ayn,Its working fine..........</P> Mon, 07 May 2012 04:37:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-matching-values-from-an-event-using-regex/m-p/44439#M10481 john 2012-05-07T04:37:18Z