https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303555#M91318 <P>Hi @somesoni2,<BR /> that's a good example! just one thing in <CODE>FORMAT</CODE> whether we need to write <CODE>$1::$3</CODE> or does it work with <CODE>$!::$2</CODE>?</P> Wed, 21 Feb 2018 19:52:36 GMT 493669 2018-02-21T19:52:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303552#M91315 <P>I am trying to extract both sha256 values from the event below but Splunk is only extracting the first value. How can I fix this?</P> <PRE><CODE>2018-02-21T13:38:23+00:00 dummy.com amp_log: Info: Compressed/Archive File: sha256 = 12345 MID = 0001, Extracted File: File Name = 'data', File Type = 'image/x-emf', sha256 = 567890, Disposition = FILE UNKNOWN, Response received from = Cloud, Malware = None, Reputation Score = 0, upload_action = 1 </CODE></PRE> Wed, 21 Feb 2018 19:09:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303552#M91315 ssyed2009 2018-02-21T19:09:08Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303553#M91316 <P>Hi @ssyed2009,<BR /> you need <CODE>max_match=0</CODE> to match multiple events<BR /> try this:</P> <PRE><CODE>...|rex max_match=0 "sha256\s*=\s*(?&lt;sha&gt;\d+)" </CODE></PRE> Wed, 21 Feb 2018 19:21:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303553#M91316 493669 2018-02-21T19:21:49Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303554#M91317 <P>Try this (on your search head(s). Splunk restart required)</P> <P>props.conf</P> <PRE><CODE>[yourSourceType] REPORT-extractall = extractAllKV </CODE></PRE> <P>transforms.conf</P> <PRE><CODE>[extractAllKV] REGEX = (\w+)\s*=(\s|\'|\")*([^,'\"\s]+) FORMAT = $1::$2 MV_ADD = true </CODE></PRE> Wed, 21 Feb 2018 19:27:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303554#M91317 somesoni2 2018-02-21T19:27:32Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303555#M91318 <P>Hi @somesoni2,<BR /> that's a good example! just one thing in <CODE>FORMAT</CODE> whether we need to write <CODE>$1::$3</CODE> or does it work with <CODE>$!::$2</CODE>?</P> Wed, 21 Feb 2018 19:52:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303555#M91318 493669 2018-02-21T19:52:36Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303556#M91319 <P>it did work with FORMAT = $1::$2</P> Tue, 27 Feb 2018 17:47:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-multiple-values-for-a-field-in-the-same-event/m-p/303556#M91319 ssyed2009 2018-02-27T17:47:25Z