Hi Splunkers,
I know that it is possible to match multiple times using rex
(using max_match=0).
Can I apply the same logic to a field extraction? I tried .../g
,/.../g
, (?g)...
, none of these work.
I managed to get the output I want using multiple EXTRACTs in props.conf:
EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)
I did not know you could specify an extraction with multiple expressions.
I managed to get the output I want using multiple EXTRACTs in props.conf:
EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)
I did not know you could specify an extraction with multiple expressions.
If you mean an index-time field extraction then you probably want to add MV_ADD=true
to your transforms.conf file.
No, I am talking about field extraction configured in props.conf...
How are you doing them in props? Please share your config.
[aws:sqs]
KV_MODE = none
TIME_PREFIX = \"eventTimestamp\\\":\\\"
#2017-07-19T16:03:42.195Z
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q%Z
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = False
LINE_BREAKER = ([\n\r]+)\{\"MD5
TRUNCATE = 999999
CHARSET = UTF-8
EXTRACT-eventAction,eventCategory,eventLabel,eventTimestamp,adid,userid = (?:\\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)|\\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)|\\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)|\\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)|\\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)|\\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*))+