topic Re: Extracting multiple values for single field in Splunk Search

Extracting multiple values for single field

ebs — Wed, 04 Nov 2020 02:41:04 GMT

I'm trying to extract multiple values for a single field. I've got the beginnings of the regex sorted to extract it, but I don't know how to separate the values. For below rather than have gzip,deflate as a single value I'd like gzip and deflate as separate values. Does anyone have any advice?

Regex: Accept-Encoding: (?P<encoder>\w+.*?)\\n>>

Log: Accept-Encoding: gzip,deflate\n>>

Results: (attached image)

Re: Extracting multiple values for single field

bowesmana — Wed, 04 Nov 2020 05:57:19 GMT

Try this

Re: Extracting multiple values for single field

ebs — Sun, 08 Nov 2020 22:29:31 GMT

Is there a way to do this as an field extraction? As in something I can do the regex for once and it be permanently present or would I only be able to do this extraction at search time?

Re: Extracting multiple values for single field

bowesmana — Sun, 08 Nov 2020 23:15:50 GMT

You can do this as a field extraction. Just create a new field extraction through the UI, or via the configuration files

https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Configureinlineextractions

I am not totally sure if that regex will extract the encoder field as multiple when done through the field extraction process, but it _should_ be possible.