topic Re: How do I make a field extraction that selects only the first occurrence? in Splunk Search

How do I make a field extraction that selects only the first occurrence?

whrg — Tue, 04 Dec 2018 13:32:38 GMT

Hello,
I have events that span multiple lines. One such event looks as follows:

...
# User details
ID: 123
Username: admin
Group: admin
Group: bin
...

Each event has at least one Group line.

I want to create a field extraction for the first occurence of Group.

So, for the example above the extracted field should have the value admin.

How do I create such a field extraction?

Re: How do I make a field extraction that selects only the first occurrence?

skoelpin — Tue, 04 Dec 2018 14:48:24 GMT

Try this

| rex Group:\s(?<group>\w+)\n+

Re: How do I make a field extraction that selects only the first occurrence?

whrg — Wed, 05 Dec 2018 07:41:30 GMT

Thank you for your answer!
When I test your regex then I see there are two match objects:
https://regex101.com/r/lQXqFx/1
How will Splunk behave in this case?

Re: How do I make a field extraction that selects only the first occurrence?

dkeck — Wed, 05 Dec 2018 09:32:12 GMT

try this in splunk with the rex command its working

Re: How do I make a field extraction that selects only the first occurrence?

whrg — Wed, 05 Dec 2018 11:42:00 GMT

It is working.
However, I cannot find any documentation as to Splunk handles multiple match objects.

Re: How do I make a field extraction that selects only the first occurrence?

dkeck — Wed, 05 Dec 2018 12:08:35 GMT

by default its matching ungreedy, and if you want it to be global you can add flaggs.

I am not sure if there is any doc on that.

Re: How do I make a field extraction that selects only the first occurrence?

skoelpin — Wed, 05 Dec 2018 14:51:19 GMT

It's working off that \n+ added at the end, saying grab only the first match. If this answered your question, please accept it and close it out