topic Re: How to extract fields at search-time from a multivalue query string? in Splunk Search

How to extract fields at search-time from a multivalue query string?

bkchung — Tue, 07 Oct 2014 23:01:10 GMT

Using sourcetype="localapache", extracting fields from the following event only recognizes somevalues but not somevalues2:

::1 - - 2014-10-03 16:10:27.444 Pacific Daylight Time 80 "GET /blah?wp={somevalues}&wp={somevalues2}&more={someother} HTTP/1.1" "-" 204 - "-" 1000

I'm doing the following:
sourcetype="localapache" source=access "GET /blah" | fields + wp | rex fields = wp "{...(?<something>...}" | table wp, something

Both the names of the pair is "wp". Is there any workaround for this?

(Edited some formatting problems with amp,gt,lt, etc.)

Re: How to extract fields at search-time from a multivalue query string?

somesoni2 — Wed, 08 Oct 2014 01:40:43 GMT

Try this

sourcetype="localapache" source=access "GET /blah"  | rex field=wp max_match=0 "wp=(?<something>\w+)" | table something

Re: How to extract fields at search-time from a multivalue query string?

bkchung — Wed, 08 Oct 2014 21:39:07 GMT

I did try max_match=0 but it didn't work for me.

Re: How to extract fields at search-time from a multivalue query string?

somesoni2 — Wed, 08 Oct 2014 21:51:27 GMT

Remove field=wp from above and try again.

Re: How to extract fields at search-time from a multivalue query string?

bkchung — Wed, 08 Oct 2014 22:33:41 GMT

Got your point. Yes, "wp" will be "somevalues" assuming that "something" is "\w+". But this, I would need to rewrite the regex to parse the query strings case by case rather than rely on the existing auto field extraction to treat multivalue cases which is useful if you don't know the fields and presumed values. I was thinking there might be a workaround to do that with "fields + wp" (also for performance).