https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287410#M87001 <P>In the transforms, you need to use <CODE>MV_ADD=true</CODE></P> <PRE><CODE>MV_ADD = [true|false] * NOTE: This attribute is only valid for search-time field extractions. * Optional. Controls what the extractor does when it finds a field which already exists. * If set to true, the extractor makes the field a multivalued field and appends the * newly found value, otherwise the newly found value is discarded. * Defaults to false </CODE></PRE> Mon, 06 Jun 2016 20:15:32 GMT sundareshr 2016-06-06T20:15:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287405#M86996 <P>This is the first time I am using IFE and having some difficulty extracting data. I am not good at regex, so I used the Interactive Field Extractor to extract the field. </P> <P>I have the string <CODE>trans(1234)</CODE> in the records. I am creating a field <STRONG>Trans</STRONG> - this field is storing the number inside the brackets as the value. In this case, Value is 1234. I have multiple such trans(####) vales in one entry. Splunk is identifying just the first occurring such trans(value) in each record. Is there a way to identify all of the different trans() in each event as a separate entry? </P> <P>Also is there a good documentation with examples on how to write rex for beginners? </P> Mon, 06 Jun 2016 18:02:49 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287405#M86996 sushmitha_mj 2016-06-06T18:02:49Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287406#M86997 <P>IFX does not do well with regex and particularly with multi-value fields. Try this in your search instead</P> <PRE><CODE>.... | rex max_match=0 "trans\((?&lt;trans&gt;\d+)\)" | table trans </CODE></PRE> Mon, 06 Jun 2016 18:11:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287406#M86997 sundareshr 2016-06-06T18:11:15Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287407#M86998 <P>Do you suggest I use this expression in the "write your own regular expression section inside the Extract fields? </P> <P>When I write it as a query it works but inside the extract fields regex it does not work.... </P> Mon, 06 Jun 2016 19:03:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287407#M86998 sushmitha_mj 2016-06-06T19:03:29Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287408#M86999 <P>you cannot use max_match in IFX. However, you update your conf files to extract this field at search time. Here's some good docs on that <A href="http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Steps_for_defining_custom_search-time_field_extractions_that_reference_field_transforms" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles#Steps_for_defining_custom_search-time_field_extractions_that_reference_field_transforms</A></P> Tue, 29 Sep 2020 09:53:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287408#M86999 sundareshr 2020-09-29T09:53:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287409#M87000 <P>If I put this on the regex part : trans((?\d+)) It identifies the first trans id in each event. How can I extract all the trans as a separate field? I am unable to specify max_match =0. </P> Mon, 06 Jun 2016 20:03:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287409#M87000 sushmitha_mj 2016-06-06T20:03:02Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287410#M87001 <P>In the transforms, you need to use <CODE>MV_ADD=true</CODE></P> <PRE><CODE>MV_ADD = [true|false] * NOTE: This attribute is only valid for search-time field extractions. * Optional. Controls what the extractor does when it finds a field which already exists. * If set to true, the extractor makes the field a multivalued field and appends the * newly found value, otherwise the newly found value is discarded. * Defaults to false </CODE></PRE> Mon, 06 Jun 2016 20:15:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287410#M87001 sundareshr 2016-06-06T20:15:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287411#M87002 <P>Looks like there is no way I can extract multiple values in same row using IFX then. Thanks </P> Mon, 06 Jun 2016 20:18:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-the-regex-to-extract-all-instances-of-this-field/m-p/287411#M87002 sushmitha_mj 2016-06-06T20:18:24Z