topic Re: one event one filed multi value in Splunk Search

one event one filed multi value

crazyeva — Tue, 21 Aug 2012 05:10:27 GMT

hello
I have my log form as multi lines breaked with an empty line
thanks to ziegfried， I have devided each event successfully with his help
now I want to extract a field, in each event, may covers more than one value. 1,2 maybe 3 of them, same REX.

I find slpunk can pick out the first value which match the REX express, the others are dropped.
Can splunk extract multi values in one event with one REGEX or one FIELD name?
Thank you!

Re: one event one filed multi value

kristian_kolb — Tue, 21 Aug 2012 05:43:33 GMT

Check out how to make multi-valued extraction through MV_ADD in transforms.conf

Re: one event one filed multi value

gkanapathy — Tue, 21 Aug 2012 05:59:50 GMT

You should look at the max_match parameter of the rex command.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

Re: one event one filed multi value

crazyeva — Tue, 21 Aug 2012 06:32:18 GMT

is there any way for pre-extraction
like some parameters in props.conf or transforms.conf?

Re: one event one filed multi value

Ayn — Tue, 21 Aug 2012 06:33:37 GMT

Check kristian.kolb's comment.

Re: one event one filed multi value

0waste_splunk — Mon, 19 Aug 2013 15:09:13 GMT

@kristian.kolb.

can you please explain in detail with some example?

thanks

Re: one event one filed multi value

crazyeva — Tue, 20 Aug 2013 01:44:32 GMT

Thank you very mutch.
It is realy a long cause to study on splunk.

Re: one event one filed multi value

kristian_kolb — Wed, 21 Aug 2013 15:58:32 GMT

see example in a previous post.

http://answers.splunk.com/answers/45116/xml-field-extraction?page=1&focusedAnswerId=45126#45126

Hope this helps,

Re: one event one filed multi value

crazyeva — Wed, 21 Aug 2013 18:54:51 GMT

Thank you very much