topic Re: Using inline extractions to extract multi-value fields. in Splunk Search

Using inline extractions to extract multi-value fields.

Ricapar — Fri, 21 Dec 2012 18:09:05 GMT

Here's an example of my log:

zone name PAERSCTVIH025_XIV02_z vsan 2542
  attribute broadcast
  fcalias name PACTMXIV02_P3_M789 vsan 2542
    pwwn 50:01:73:80:61:b1:01:72
    pwwn 50:01:73:80:61:b1:01:82
    pwwn 50:01:73:80:61:b1:01:92

  fcalias name PAERSCTVIH025_fc vsan 2542
    pwwn 50:01:43:80:05:6b:87:d2

I'm using the "Extract Fields" interface to try to assign field names to some of the data in the entry.

There are two things I'd like to do, not sure if it is possible to do them both.. But I'd like to try.

First one would be to just pull all of the WWNs from the event and put them in a multi-value key.

so I'd like to see something like:

pwwn = "50:01:73:80:61:b1:01:72", pwwn = "50:01:73:80:61:b1:01:82", etc..

In my search results. That way I can search for pwwn = "something", and get that back.

I have this regex for my field extraction:

pwwn (?P<FIELDNAME>[^ ]+)

But when I run the preview, it only highlights the first match in each event. I tried saving it and seeing if it behaved any differently, but it didn't.
Is there a way to specify a regex that'd match every match inside an event, instead of just the first?

Re: Using inline extractions to extract multi-value fields.

jonuwz — Fri, 21 Dec 2012 21:52:07 GMT

If you're using rex within the search, yes, you just add max_match=100 to the rex command

It you're adding extractions to props.conf its more complicated.

see this

You need to break out the extract field of pwwn, put it in transforms.conf and add MVADD = true

Post the config you have already if you need any help

Re: Using inline extractions to extract multi-value fields.

Ayn — Fri, 21 Dec 2012 22:04:28 GMT

It's max_matches (with the underscore) I believe.

Re: Using inline extractions to extract multi-value fields.

jonuwz — Sat, 22 Dec 2012 18:44:56 GMT

corrected - thanks Ayn