topic Re: INLINE EXTRACTION with /g option for RegEX in Splunk Search

INLINE EXTRACTION with /g option for RegEX

verbal_666 — Fri, 07 Jul 2023 09:42:12 GMT

Hi.
Question:
is there a way to add the classic /g option for RegEX in INLINE RegEX extractor for Splunk (props), without using command rex or other tranformations?

Example,

SerialNumber=12345,SerialNumber=67890

With a classical regex, "/SerialNumber=(?P<sn>\d+)/g" i can found "12345" & "67890".
Same with an SPL "rex max-match=0 "SerialNumber=(?P<sn>\d+)".
But how to do it in INLINE extraction?

I got rid of the "problem" using extraction of "sn1" & "sn2" fields and transforming them with an eval transformation ("sn = sn1.' , '.sn2") and it works fine. But if, tomorrow, i'll find something like

SerialNumber=12345,SerialNumber=67890,SerialNumber=09876,SerialNumber=54321

Without the rex i would be in trouble!

Thanks.

Re: INLINE EXTRACTION with /g option for RegEX

ITWhisperer — Fri, 07 Jul 2023 09:56:50 GMT

Have you tried

MV_ADD = true

Re: INLINE EXTRACTION with /g option for RegEX

verbal_666 — Fri, 07 Jul 2023 10:09:19 GMT

Mmmmm... where? 🙄😁 ... in transforms.conf?
So there is no WebIf option to do it?

Re: INLINE EXTRACTION with /g option for RegEX

isoutamo — Fri, 07 Jul 2023 10:15:58 GMT

have you try to use (?g) on beginning of regex? Another option is use transforms and then MV as @ITWhisperer already proposed.

r. Ismo

Re: INLINE EXTRACTION with /g option for RegEX

verbal_666 — Fri, 07 Jul 2023 10:17:45 GMT

I'll try the "?g" on beginning. I tried the "/g" at the end, but without success 😏
I prefer to only use props and not also transforms.
Thanks anyway.

Re: INLINE EXTRACTION with /g option for RegEX

isoutamo — Fri, 07 Jul 2023 10:19:32 GMT

Like this (?g) or just ?g, brackets is mandatory.

Re: INLINE EXTRACTION with /g option for RegEX

ITWhisperer — Fri, 07 Jul 2023 10:33:58 GMT

Example transform field extraction configurations - Splunk Documentation

Re: INLINE EXTRACTION with /g option for RegEX

verbal_666 — Fri, 07 Jul 2023 10:40:39 GMT

Ok with props & transforms solution.
Ticking the "create mv fields", adds the MV_ADD to transforms and does the trick.
I was going to prefer to only use props, but it's ok 👍👍👍

ps. the "(?g)" text in regex INLINE gives errors in regex format.

Thanks all 😊