Extract value from fields that are named the same

[hippe21]

Here's some sample data:

appName=test-application projectId=unknown projectName=My Test, id=123, projectId=12345abcde000, file=testing, other data...

The issue I have is, the first projectId value is being auto extracted, therefore projectId=unknown. If I attempt to run anything against this data for projectId, unknown is always returned.

With this sample data having 2 fields with the exact same name, how can I extract the one I actually need (2nd projectId), which in this sample, would be projectId=12345abcde000?

[DalJeanis · Accepted solution]

First, you can (and should) set the extract for projectid to allow multiple extractions of the field. These two are the lines either or both of which may need to get added to the appropriate stanza in transforms.conf:

REPEAT_MATCH=TRUE
MV_ADD = TRUE

For more info, here's one example answer - https://answers.splunk.com/answers/484037/multi-value-field-extraction-propsconf-transformsc.html

Second, for items that have already been indexed, you can do this at search time -

| rex field=_raw "projectId=(?<projectId>\w+)\b" max_match=0
| eval projectId=mvfilter(NOT match(projectId,"unknown"))

---

[hippe21]

Thank you, this is exactly what I was looking for!