https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370441#M169828 <P>Without trying - the datamodels are saved as a file, maybe you can try to manually manipulate/add that setting there? </P> Sun, 29 Apr 2018 13:36:48 GMT xpac 2018-04-29T13:36:48Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370440#M169827 <P>In the definition of a datamodel, I would like to use a regular expression with argument max_match=10 or max_match=0. In the datamodel editor this doesn't seem to be possible.</P> <P>Any thoughts?</P> Tue, 29 Sep 2020 19:18:33 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370440#M169827 tonniea 2020-09-29T19:18:33Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370441#M169828 <P>Without trying - the datamodels are saved as a file, maybe you can try to manually manipulate/add that setting there? </P> Sun, 29 Apr 2018 13:36:48 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370441#M169828 xpac 2018-04-29T13:36:48Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370442#M169829 <P>Thanks for the hint. In the JSON export I found a multivalue option that I'm going to try. Too bad this isn't accessible via the editor.</P> Mon, 30 Apr 2018 06:10:39 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370442#M169829 tonniea 2018-04-30T06:10:39Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370443#M169830 <P>Good to know. Now that you have the details at hand, you could post an answer to your own question so others Googling for it can profit of your experience <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Mon, 30 Apr 2018 07:01:37 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370443#M169830 xpac 2018-04-30T07:01:37Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370444#M169831 <P>Yep, sure...</P> <P>In the field definition of the datamodel for your rex field you find this:</P> <P>"calculationType":"Rex","expression":"(?[^&lt;]<EM>?)&lt;"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,</EM><EM>"multivalue":false</EM>*,"hidden":false...etc</P> <P>If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.</P> Mon, 30 Apr 2018 07:09:02 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370444#M169831 tonniea 2018-04-30T07:09:02Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370445#M169832 <P>Reposting the comment of @tonniea so it doesn't get lost <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <PRE><CODE>In the field definition of the datamodel for your rex field you find this: "calculationType":"Rex","expression":"(?[^&lt;]?)&lt;"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended. </CODE></PRE> Mon, 30 Apr 2018 08:04:10 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370445#M169832 xpac 2018-04-30T08:04:10Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370446#M169833 <P>Hi,</P> <P>i have tried this approach, changed multivalve to true and restarted Splunk. Sadly it didn't work in 7.2.6.<BR /> Is there something different? How else can I put into data model regular expression fields with max_match=0?</P> <P>Best regards<BR /> Tomasz</P> Fri, 17 May 2019 18:44:17 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370446#M169833 tomaszwrona 2019-05-17T18:44:17Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370447#M169834 <P>did u get this to work?</P> Mon, 20 Jan 2020 14:24:09 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-max-match-inside-a-datamodel-rex/m-p/370447#M169834 monteiroh 2020-01-20T14:24:09Z