topic Re: Extract multiple values with the same delimiter in Splunk Search

How to extract multiple values with the same delimiter?

christopheducha — Thu, 30 Jul 2020 04:58:19 GMT

I'm trying to regex my way into this puzzle, let me explain my problem.

event 1 (field 2) raw value = log:word1 log:word2 log:word3 event 2 (field 2) raw value = log:19 log:word4

The value in field2 from the first event (raw value). log:word1 log:word2 log:word3 The value in field2 from the second event (raw value). log:19 log:word4

I want to extract these "log:" values into 3 fields.
Something like field log1 , log2 and log3.

So I tried with this regex :

":(?<log1>\S*) log:(?<log2>\S*) log:(?<log3>\S*)"

Works perfectly with event 1, but didn't work for event 2 because there or only 2 “log:” values.

Can anybody tell me how to make this work?

Re: Extract multiple values with the same delimiter

bowesmana — Wed, 29 Jul 2020 23:27:03 GMT

You can make the regex use quantifiers, so that 2nd and subsequent extractions are optional using ?

| makeresults | eval v=split("log:word1 log:word2 log:word3,log:19 log:word4",",") | mvexpand v | rex field=v ":(?<log1>\S*)( log:(?<log2>\S*))?( log:(?<log3>\S*))?"

Hope this helps

Re: Extract multiple values with the same delimiter

spitchika — Wed, 29 Jul 2020 23:40:21 GMT

This will give all log values irrespective of number logs. Trick is you need use "max_match" option with rex.