Hello Splunkers,
I have a index-time field extraction question, here is my raw log :
wheel:x:10:user1,user2,user3
I would like to use props.conf and transforms.conf to extract the users
props.conf :
[mysourcetype]
LINE_BREAKER = ([\r\n]+)
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
TRANSFORMS-users = get-users
transforms.conf :
[get-users]
REGEX = (\d:|,)(?<user>\w+)
FORMAT = users::$1
With my current config, I will only be able to extract the first match of my regex who is here the user1.
How could I extract and store each user value ?
Thanks for your time,
GaetanVP
Index-time extractions don't have an equivalent to the max_match option of the rex command. Consider extracting all users together and then extracting them at search time.
[get-users]
REGEX = (\d:)(?<user>.+)
FORMAT = users::$1
Index-time extractions don't have an equivalent to the max_match option of the rex command. Consider extracting all users together and then extracting them at search time.
[get-users]
REGEX = (\d:)(?<user>.+)
FORMAT = users::$1
Hello @richgalloway,
Thanks for the information, I will try to do that !
Regards,
GaetanVP