topic Re: Extract multiple values when field is in the same log twice in Splunk Search

Extract multiple values when field is in the same log twice

bcarr12 — Wed, 05 Jul 2017 18:42:29 GMT

Hi all,

I am working with a log that can sometimes have the same field in one log entry more than one time, but with multiple values.

Examples:

Ex 1:
100=A

Ex 2:
100=A 100=B 100=C

Ex 3:
100=D

Ex 4:
100=A 100=D

As I've seen discussed before, Splunk only seems to pull the first value out whenever the field is repeated. What would be the best way to tell Splunk at searchtime that I want to pull all "100" values from the log and not just the first one?

Re: Extract multiple values when field is in the same log twice

DalJeanis — Wed, 05 Jul 2017 18:48:48 GMT

Try this -

| rex field=_raw "100=(?<my100>\w+)" max_match=0

Re: Extract multiple values when field is in the same log twice

cpetterborg — Wed, 05 Jul 2017 18:51:10 GMT

If you just want to get the values in the same field as a multivalve field, then this type search should work:

| makeresults | eval _raw="100=A 100=B 100=C" | rex field=_raw max_match=10 "100=(?P<field100>\w+)"

Re: Extract multiple values when field is in the same log twice

bcarr12 — Wed, 05 Jul 2017 18:53:37 GMT

Thanks, this worked perfectly!

Re: Extract multiple values when field is in the same log twice

bcarr12 — Wed, 05 Jul 2017 18:53:52 GMT

Thanks for the suggestion!

Re: Extract multiple values when field is in the same log twice

xlash911 — Thu, 19 Dec 2019 18:44:21 GMT

Saved my life, thanks!