Extracting multiple values for single field

[ebs]

I'm trying to extract multiple values for a single field. I've got the beginnings of the regex sorted to extract it, but I don't know how to separate the values. For below rather than have gzip,deflate as a single value I'd like gzip and deflate as separate values. Does anyone have any advice?

Regex: Accept-Encoding: (?P<encoder>\w+.*?)\\n>>

Log: Accept-Encoding: gzip,deflate\n>>

Results: (attached image)

[bowesmana]

Try this

| makeresults
| eval Log="Accept-Encoding: gzip,deflate\n>>"
| rex field=Log max_match=0 "(?:Accept-Encoding: )?(?<encoder>\w+)(,|\\\n>>)?"
| table Log encoder

[ebs]

Is there a way to do this as an field extraction? As in something I can do the regex for once and it be permanently present or would I only be able to do this extraction at search time?

[bowesmana]

You can do this as a field extraction. Just create a new field extraction through the UI, or via the configuration files

https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Configureinlineextractions

I am not totally sure if that regex will extract the encoder field as multiple when done through the field extraction process, but it _should_ be possible.