Splunk Search

Extracting multiple values for single field

ebs
Communicator

I'm trying to extract multiple values for a single field. I've got the beginnings of the regex sorted to extract it, but I don't know how to separate the values. For below rather than have gzip,deflate as a single value I'd like gzip and deflate as separate values. Does anyone have any advice?

Regex: Accept-Encoding: (?P<encoder>\w+.*?)\\n>>

Log: Accept-Encoding: gzip,deflate\n>>

Results: (attached image)

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Try this

| makeresults
| eval Log="Accept-Encoding: gzip,deflate\n>>"
| rex field=Log max_match=0 "(?:Accept-Encoding: )?(?<encoder>\w+)(,|\\\n>>)?"
| table Log encoder

 

0 Karma

ebs
Communicator

Is there a way to do this as an field extraction? As in something I can do the regex for once and it be permanently present or would I only be able to do this extraction at search time?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can do this as a field extraction. Just create a new field extraction through the UI, or via the configuration files

https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Configureinlineextractions

I am not totally sure if that regex will extract the encoder field as multiple when done through the field extraction process, but it _should_ be possible.

 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...