All Apps and Add-ons

Can Splunk extract more than 6 regular expression in the same time?

royimad
Builder

Hello Splunk experts,

Can Splunk extract more then 6 regular expression in the same time?

Example:
sourcetype="imap"
| rex field=_raw "(?ms)(?Total.)^"
| rex field=capture "-(?.
)"
| rex field=dash "-(?.)"
| rex field=seconddash "-(?.
)"
| rex field=thirddash "-(?.)"
| rex field=fourthdash "-(?.
)"
| rex field=fifthdash "-(?.)"
| rex field=sixdash "-(?.
)"

The sevendash field is not appearing while i need to continue till the end and choose the last fields.

0 Karma

rdownie
Communicator

I am not exactly sure what you are trying to accomplish here. Can you show a sample of the raw event this would go against?


Would it be easier to do the regex all in one rex command?


Does the event have "-" seperated fields? If so, would it make sense to use a transform using DELIMS?


You can extract more than 6 fields.

0 Karma

rturk
Builder

Can you give a redacted sample of the events you're attempting to parse - the way you've approached this doesn't seem ideal...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...