Hello, How can I make a field extraction match multiple times on a given line?
here's an example:
datetime=1355871514&reason_code=reason1&reason_code=reason2&id=123456
I'd like the field to show "reason_code" = "reason1" and "reason2".
Thanks, Brian
Got it, see this: http://splunk-base.splunk.com/answers/13286/multiple-values-per-key-in-one-record
Right now, this does not match both, only the first match.
(?i)&reason_code=(?P[^&]+)
