I'm trying to extract multiple values for a single field. I've got the beginnings of the regex sorted to extract it, but I don't know how to separate the values. For below rather than have gzip,deflate as a single value I'd like gzip and deflate as separate values. Does anyone have any advice?
Regex: Accept-Encoding: (?P<encoder>\w+.*?)\\n>>
Log: Accept-Encoding: gzip,deflate\n>>
Results: (attached image)
Try this
| makeresults
| eval Log="Accept-Encoding: gzip,deflate\n>>"
| rex field=Log max_match=0 "(?:Accept-Encoding: )?(?<encoder>\w+)(,|\\\n>>)?"
| table Log encoder
Is there a way to do this as an field extraction? As in something I can do the regex for once and it be permanently present or would I only be able to do this extraction at search time?
You can do this as a field extraction. Just create a new field extraction through the UI, or via the configuration files
https://docs.splunk.com/Documentation/Splunk/8.1.0/Knowledge/Configureinlineextractions
I am not totally sure if that regex will extract the encoder field as multiple when done through the field extraction process, but it _should_ be possible.