topic Re: Unable to Extract Multiple values into a single feild ? in Splunk Search

Unable to Extract Multiple values into a single feild ?

rakshithreddy — Tue, 29 Sep 2020 14:29:02 GMT

Hi Everyone,

I was unable to extract multiple Values into one feild from the the below Event data,
Was trying to extract all data between xyz - /xyz into one single feild,
Its working with including |rex max_match=100 - in the search query as ( search |rex max_match=100 "xyz(?P.*?)\/xyz>" )
But looking for an alternative which extracts multiple values into one single feild at writing regular expression level.

ams
xyzStats.QuarterHour.CRCErrors/xyz>\x1B

xyzQuarterHourStart/xyz>\x1B

xyzDownstreamNoiseMargin/xyz>\x1B

xyzUpstreamCurrRate/xyz>\x1B

xyz.WANDSLInterfaceConfig.Status/xyz>\x1B
/ams>\x1B

Thank you.

Re: Unable to Extract Multiple values into a single feild ?

cmerriman — Tue, 29 Sep 2020 14:32:01 GMT

you're looking for another way besides using max_match? or you want another regex statement? I'm not sure you can extract an MV field without the max_match, but i could be wrong.

Re: Unable to Extract Multiple values into a single feild ?

niketn — Tue, 29 Sep 2020 14:32:22 GMT

You might have to put code sections of your question using code button (101010) to avoid escaping.

Rex will generate field with multiple values is you have enables max_match=100. You can set the same to zero if you want to find all matches i.e. max_match=0.

So, you might have to also explain what is it that you intend to do with your data and also with is the current issue with rex using max_match?

Re: Unable to Extract Multiple values into a single feild ?

rakshithreddy — Tue, 20 Jun 2017 18:57:35 GMT

Thank you,
Cant find how to Extract MVfield without max_match.

Re: Unable to Extract Multiple values into a single feild ?

DalJeanis — Tue, 20 Jun 2017 19:03:24 GMT

Be sure to mark your code as code so the interface doesn't act on what it thinks are html tags or formatting commands.

It sounds like you are looking for the nomv command, which turns a multivalue field into a regular field separated by (usually) spaces ...

your search
| rex max_match=0 "xyz(?<myXyz>[^\/]*)\/xyz>"
| nomv myXyz

By the way, when you know that a field will never include a particular character and will always end on that character, you can use that single character as a negative character class, which makes the rex slightly more efficient in the case of a near-but-nonmatch.

Re: Unable to Extract Multiple values into a single feild ?

rakshithreddy — Tue, 29 Sep 2020 14:37:15 GMT

Thanks for the revert. I understand that max_match=0 will give me the desired result. But in all the search queries wherever i need to extract that respective filed i have to write the rex.

is there a way that whenever i am having max_match i can configure it in Splunk and automatic fields get extracted. I tried but automatic filed extractor doesn't accept max_match parameter.