https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67850#M16952 <P>Hello,<BR /> How can I make a field extraction match multiple times on a given line? </P> <P>here's an example:</P> <P>datetime=1355871514&amp;reason_code=reason1&amp;reason_code=reason2&amp;id=123456</P> <P>I'd like the field to show "reason_code" = "reason1" and "reason2".</P> <P>Thanks,<BR /> Brian</P> Mon, 28 Sep 2020 12:59:18 GMT BP9906 2020-09-28T12:59:18Z https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67850#M16952 <P>Hello,<BR /> How can I make a field extraction match multiple times on a given line? </P> <P>here's an example:</P> <P>datetime=1355871514&amp;reason_code=reason1&amp;reason_code=reason2&amp;id=123456</P> <P>I'd like the field to show "reason_code" = "reason1" and "reason2".</P> <P>Thanks,<BR /> Brian</P> Mon, 28 Sep 2020 12:59:18 GMT https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67850#M16952 BP9906 2020-09-28T12:59:18Z https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67851#M16953 <P>Right now, this does not match both, only the first match.</P> <P>(?i)&amp;reason_code=(?P<FIELDNAME>[^&amp;]+)</FIELDNAME></P> Tue, 18 Dec 2012 23:31:17 GMT https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67851#M16953 BP9906 2012-12-18T23:31:17Z https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67852#M16954 <P>Got it, see this:<BR /> <A href="http://splunk-base.splunk.com/answers/13286/multiple-values-per-key-in-one-record">http://splunk-base.splunk.com/answers/13286/multiple-values-per-key-in-one-record</A></P> Wed, 19 Dec 2012 00:07:44 GMT https://community.splunk.com/t5/Splunk-Search/Field-Extraction-Multiple-Matches-same-line/m-p/67852#M16954 BP9906 2012-12-19T00:07:44Z