topic Re: Two multivalue fields needed in Splunk Search

Two multivalue fields needed

wkassel — Wed, 26 Jul 2017 18:29:07 GMT

Hi - I need to extract two multivalue fields from each event. Let's say the strings are "AAA-" and "BBB-". Each string is followed by a number after the hyphen. An event will have one or both of these strings and possibly multiples of each, hence multivalue. I can pipe the search to a rex command (e.g. |rex max_match=0 "(?AAA-[0-9]+)") which gets me the multivalues of AAA- for each event but how can I include BBB- if it exists in the event as well, or vice versa ?

Thanks,
W

Re: Two multivalue fields needed

richgalloway — Wed, 26 Jul 2017 18:45:09 GMT

If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".

| rex max_match=0  "(?<foo>(?:AAA|BBB)-[0-9]+)"

You can use regex101.com to test possible regex strings against sample data.

Re: Two multivalue fields needed

wkassel — Wed, 26 Jul 2017 19:15:06 GMT

Brilliant! I was trying to get two multivalue fields extracted but no reason they can't be in one field in this case. Great idea! Thank you.

Re: Two multivalue fields needed

richgalloway — Thu, 27 Jul 2017 11:31:22 GMT

If your problem is solved, please accept the answer to help future readers.