Extracting multiple values from single unstructured event

[dkgs]

Hi,

In a single event, we have a field named username which is occurring multiple time in the events in raw data and username are different. How can we extract this username field since there are multiple values in the same event. Please help, this is the SAP spool data which is forwarded to splunk cloud. Attaching the screensho with mutiple usernames in single event

[ITWhisperer · Accepted solution]

Looks like you need something like

...
| rex max_match=0 field=_raw "LINE\":\"\|(?<user>[^\s]*)\s"
| mvexpand user

[dkgs]

 @ITWhisperer Thank you , the expression is working fine in search.

When I am trying to give the same expression while extracting fields, so that the field user will be permanent, Its not working. I had chosen 'I prefer to write the regular expression myself '   and had added the expression. But I am not able to view the field.Could you please suggest whats causing the issue, but the same is working in search.

Attaching screenshot for reference. Please suggest if its the same way we have to give regular expression while extracting fields

[ITWhisperer]

Hi @dkgs 

You can only provide the expression 

LINE\":\"\|(?<user>[^\s]*)\s

Unfortunately, I can't see a way of providing the max_match=0 part so you will only be able to extract the first match.

To get all the instances in a multivalue field on a more permanent basis, you may have to adopt the transforms and props configuration approach