Splunk Search

Can multiple values be extracted for a single field for a single event?

hans
Splunk Employee
Splunk Employee

If I have one event such as:

2010-06-10 15:01:16,882 .main INFO :: x=1 x=12 x=154 x=123 x=123

will it be able to extract all the values? Which means when searching for any of the values for x above, the event will be returned.

Another example is:

2010-06-10 15:01:16,882 .main INFO :: _1 _12 _154 _123 _123

Can any of the digits after the underscore '_' be extracted into a single field?

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

All of them can be extracted. In conf files, you can set the MV_ADD parameter (which actually is on by default) and when using the rex command you can use set max_match (starting in 4.1).

Note btw, in the first case, even if you don't do a field extraction, you can search on "x=1" and it will work, as will "x=154", as you're simply searching on that string in the log file. Note that this is different from searching on x="1" or x="154". (And if you enter x=154 in the UI, it gets rewritten as x="154".) In these latter cases, x must extracted with the appropriate field values.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

All of them can be extracted. In conf files, you can set the MV_ADD parameter (which actually is on by default) and when using the rex command you can use set max_match (starting in 4.1).

Note btw, in the first case, even if you don't do a field extraction, you can search on "x=1" and it will work, as will "x=154", as you're simply searching on that string in the log file. Note that this is different from searching on x="1" or x="154". (And if you enter x=154 in the UI, it gets rewritten as x="154".) In these latter cases, x must extracted with the appropriate field values.

hans
Splunk Employee
Splunk Employee

It works with rex. I wonder if max_match setting can be saved in field extraction or field transform.

0 Karma

Simeon
Splunk Employee
Splunk Employee

I believe that only one of the values will get extracted, probably the first value.

You should setup a proper regex to extract the separate field values. However, searching for the value itself should not be a problem.

If you elaborate on the use-case, that might allow people to offer you more commentary.

gkanapathy
Splunk Employee
Splunk Employee

All of them can be extracted. In conf files, you can set the MV_ADD parameter (which actually is on by default) and when using the rex command you can use set max_matches (starting in 4.1).

0 Karma

hans
Splunk Employee
Splunk Employee

I don't have any real world use case but my scenario would be for a set of events that have x as a field, I want to see how many different values of x does that set have.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...