topic Re: Extract values from all matches in regex in Splunk Search

Extract values from all matches in regex

pbarford — Wed, 09 Oct 2013 10:17:35 GMT

I have a line in my log like this

013-09-30 23:55:32,954 [pool-13-thread-18655] INFO c.p.d.r.c.release.MessageReleaser Expiry triggered for [1904614]: L[769] R[770] R[771] R[772] R[773] L[774] R[775] L[776] R[777]

If I run this

sourcetype="log4j" | search "Expiry" | rex "(?L[[0-9]{1,45}])"

it only gives me the first value "L[769]", I want to extract values for all matches. Have search through the forum and haven't found anything to help, any ideas?

Re: Extract values from all matches in regex

gfuente — Wed, 09 Oct 2013 10:21:28 GMT

Hello

try this:

sourcetype="log4j" | search "Expiry" | rex max_match=10 "(?<seqno>L[[0-9]{1,45}])"

Regards

Re: Extract values from all matches in regex

pbarford — Wed, 09 Oct 2013 10:24:52 GMT

wow thanks for the quick answer, worked

Re: Extract values from all matches in regex

alacercogitatus — Wed, 09 Oct 2013 11:21:07 GMT

But you are missing the R values. Do this regex: (?<seqno>[LR]\[[\d]+\])