Trying to extract all email attachments file names. I am no good with Rex/Regex, so I used the automatic extraction in Splunk... However, the extraction is only pulling the first file name, never anything after.
In Splunk on the Extraction/Transfor, field I got
Need to know what to add in order for it to loop through for each attachment.
Can you please share sample logs? Also, if your rex is working fine then can you try adding
max_match = 0 after the
rex which will help you in looping through each attachment.
You need to provide us a sample of your logs. One suggestion - your regex is probably not working. You need to write your own regex and not depend on extract from splunk web, If you do provide us a some samples we can surely help you on this
@biers04 - is this still an issue? If so, please post some non-confidential samples of the events you are trying to extract. When you post the data, or when you post code, please be sure to mark it with the code button (101 010) or surround it with grave accents (the ones on the tilde key ~), or put at least four spaces before each line, so that the interface will not treat html-like data as html or xml code.