https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29301#M177922 <P>oh..in that case can you transform my rex above to transforms.conf pls..</P> Tue, 12 Feb 2013 18:52:06 GMT rakesh_498115 2013-02-12T18:52:06Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29299#M177920 <P>Hi ..</P> <P>For all the regular expression fields created using rex command , there is option called max_match to match all the occurrences of the rex field. Can i know where we will define this option ..to reflect to all the rex fields..</P> <P>In my props.conf..<BR /> i have something like this</P> <P>EXTRACT-myapps:<PRODUCT>(?<PRODUCTNAME>[^&lt;]*)&lt;</PRODUCTNAME></PRODUCT></P> <P>So for this field ProductName i want to increase the max_match count or i need to keep max_match = 0 to match all the occurences possible....<BR /> Query used with max_match :</P> <P>sourcetype="myapps" | rex max_match=0 "<PRODUCT>(?<PRODUCTNAME>[^&lt;]*)&lt;" | top ProductName</PRODUCTNAME></PRODUCT></P> <P>If i give it query its working but i need to know whether i can give in my conf files..please help..</P> Mon, 28 Sep 2020 13:18:17 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29299#M177920 rakesh_498115 2020-09-28T13:18:17Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29300#M177921 <P>You can't.</P> <P>You need to move the extraction to transforms.conf, and specify MV_ADD=true</P> <P>I dont think you can specify a max_matches, it'll just find them all.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles">docs</A></P> Tue, 12 Feb 2013 18:26:06 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29300#M177921 jonuwz 2013-02-12T18:26:06Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29301#M177922 <P>oh..in that case can you transform my rex above to transforms.conf pls..</P> Tue, 12 Feb 2013 18:52:06 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29301#M177922 rakesh_498115 2013-02-12T18:52:06Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29302#M177923 <P>You try it, and if you get stuck, post what you tried, and why it didn't work.</P> Tue, 12 Feb 2013 19:06:20 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29302#M177923 jonuwz 2013-02-12T19:06:20Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29303#M177924 <P>Thanks jonuwz..I finally managed to get it...:)</P> Fri, 15 Feb 2013 18:55:32 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29303#M177924 rakesh_498115 2013-02-15T18:55:32Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29304#M177925 <P>good man. the world of transform opens up a world of possibilities</P> Fri, 15 Feb 2013 19:08:57 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29304#M177925 jonuwz 2013-02-15T19:08:57Z https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29305#M177926 <P>yeah its really.. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 15 Feb 2013 20:34:26 GMT https://community.splunk.com/t5/Splunk-Search/where-can-i-set-max-match-option/m-p/29305#M177926 rakesh_498115 2013-02-15T20:34:26Z