topic Re: How to extract all values from a field with multiple values? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285648#M86424 <P>Please click <CODE>Accept</CODE> to close the question.</P> Thu, 11 Jul 2019 05:34:39 GMT woodcock 2019-07-11T05:34:39Z How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285641#M86417 <P>Hello,</P> <P>I get the event,</P> <PRE><CODE>IP="127.0.0.1",..., TAG_NAME="GRP_ROOT_MGT", TAG_NAME="GRP_IS_MM_MGT", TAG_NAME="GRP_RB_NN_MGT", BU_NAME="BU_RB_NN", ... </CODE></PRE> <P>The problem is that, one field has multiple values and Splunk detects just the first "TAG_NAME" and ignores the second and third one. However, I need them all. How can I get all of them?</P> <P>I want something like: </P> <PRE><CODE>... TAG1="xxx", TAG2="xxx", TAG3="xxx", ... </CODE></PRE> <P>Please give me some idea or some help,<BR /> Thank you very much</P> Thu, 07 Apr 2016 11:42:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285641#M86417 Lindaiyu 2016-04-07T11:42:34Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285642#M86418 <P>If you're using the <CODE>rex</CODE> command to extract the TAG_NAME fields, be sure to add the <CODE>max_match=0</CODE> option to tell Splunk to return all instances of the field.</P> <P>If you're extracting the field some other way, please explain so we can help you.</P> Tue, 29 Sep 2020 09:22:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285642#M86418 richgalloway 2020-09-29T09:22:22Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285643#M86419 <P>Show us how you are getting the single-value field value.</P> Thu, 07 Apr 2016 15:13:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285643#M86419 woodcock 2016-04-07T15:13:20Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285644#M86420 <P>You would have to set multivalued field extractions for your data. <BR /> Using transforms (example with almost same use-case as yours) <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields">http://docs.splunk.com/Documentation/Splunk/6.0.3/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Handling_events_with_multivalue_fields</A></P> <P>Using fields.conf<BR /><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ConfigureSplunktoparsemulti-valuefields">http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/ConfigureSplunktoparsemulti-valuefields</A></P> Thu, 07 Apr 2016 16:23:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285644#M86420 somesoni2 2016-04-07T16:23:57Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285645#M86421 <P>it works with the parameter"max_match"<BR /> Thank you a lot!</P> Thu, 07 Apr 2016 16:48:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285645#M86421 Lindaiyu 2016-04-07T16:48:45Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285646#M86422 <P>Thank you for replying,<BR /> I get from a python script,<BR /> now I find a method</P> Thu, 07 Apr 2016 16:49:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285646#M86422 Lindaiyu 2016-04-07T16:49:36Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285647#M86423 <P>worked for me with same issue , this should be accepted answer <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 11 Jul 2019 02:14:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285647#M86423 sander980 2019-07-11T02:14:57Z Re: How to extract all values from a field with multiple values? https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285648#M86424 <P>Please click <CODE>Accept</CODE> to close the question.</P> Thu, 11 Jul 2019 05:34:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-all-values-from-a-field-with-multiple-values/m-p/285648#M86424 woodcock 2019-07-11T05:34:39Z