Splunk Search

Field Extraction: Regex global flag/modifier

konnex
Explorer

Hi Splunkers,

I know that it is possible to match multiple times using rex (using max_match=0).

Can I apply the same logic to a field extraction? I tried .../g,/.../g, (?g)..., none of these work.

0 Karma
1 Solution

konnex
Explorer

I managed to get the output I want using multiple EXTRACTs in props.conf:

EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)

I did not know you could specify an extraction with multiple expressions.

View solution in original post

0 Karma

konnex
Explorer

I managed to get the output I want using multiple EXTRACTs in props.conf:

EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)

I did not know you could specify an extraction with multiple expressions.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you mean an index-time field extraction then you probably want to add MV_ADD=true to your transforms.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma

konnex
Explorer

No, I am talking about field extraction configured in props.conf...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are you doing them in props? Please share your config.

---
If this reply helps you, Karma would be appreciated.
0 Karma

konnex
Explorer
[aws:sqs]
KV_MODE = none
TIME_PREFIX = \"eventTimestamp\\\":\\\"
#2017-07-19T16:03:42.195Z
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q%Z
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = False
LINE_BREAKER = ([\n\r]+)\{\"MD5
TRUNCATE = 999999
CHARSET = UTF-8

EXTRACT-eventAction,eventCategory,eventLabel,eventTimestamp,adid,userid = (?:\\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)|\\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)|\\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)|\\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)|\\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)|\\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*))+
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...