Splunk Search

Field Extraction: Regex global flag/modifier

konnex
Explorer

Hi Splunkers,

I know that it is possible to match multiple times using rex (using max_match=0).

Can I apply the same logic to a field extraction? I tried .../g,/.../g, (?g)..., none of these work.

0 Karma
1 Solution

konnex
Explorer

I managed to get the output I want using multiple EXTRACTs in props.conf:

EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)

I did not know you could specify an extraction with multiple expressions.

View solution in original post

0 Karma

konnex
Explorer

I managed to get the output I want using multiple EXTRACTs in props.conf:

EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)

I did not know you could specify an extraction with multiple expressions.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you mean an index-time field extraction then you probably want to add MV_ADD=true to your transforms.conf file.

---
If this reply helps you, Karma would be appreciated.
0 Karma

konnex
Explorer

No, I am talking about field extraction configured in props.conf...

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How are you doing them in props? Please share your config.

---
If this reply helps you, Karma would be appreciated.
0 Karma

konnex
Explorer
[aws:sqs]
KV_MODE = none
TIME_PREFIX = \"eventTimestamp\\\":\\\"
#2017-07-19T16:03:42.195Z
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q%Z
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = False
LINE_BREAKER = ([\n\r]+)\{\"MD5
TRUNCATE = 999999
CHARSET = UTF-8

EXTRACT-eventAction,eventCategory,eventLabel,eventTimestamp,adid,userid = (?:\\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)|\\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)|\\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)|\\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)|\\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)|\\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*))+
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...