topic How do I save my rex statement as a field extraction? in Splunk Search

How do I save my rex statement as a field extraction?

ifeldshteyn — Tue, 29 Sep 2020 08:47:23 GMT

I have an extraction that retrieves all the error_reason's in a long string that are separated by a substring err_sep

Example long_error_string:

"Blah blah blah error_reason=divided by zero err_sep error_reason=#num is bad$$$ err_sep error_reason=Infinite loop! err_sep"

This regex works perfectly and creates multiple error_reasons.

| rex field=long_error_string "error_reason=(?P<error_reason>.*?)err_sep" max_match=9999

I was wondering if I can replicate the same behavior using Splunk's field extraction. Without the max_match, it only gets one result and I want to get them all. I am guessing I am missing some simple setting.

Thanks.

Re: How do I save my rex statement as a field extraction?

somesoni2 — Wed, 10 Feb 2016 23:26:53 GMT

If you're looking for saving this field extraction, see below link

http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Managefieldtransforms#Review_and_update_search-time_field_transforms_in_Splunk_Web

Re: How do I save my rex statement as a field extraction?

ifeldshteyn — Thu, 11 Feb 2016 01:05:01 GMT

Oh I see that there is a "create multivalue button" in transforms. I'll try that out - thanks!