Field Extraction: Regex global flag/modifier

[konnex]

Hi Splunkers,

I know that it is possible to match multiple times using rex (using max_match=0).

Can I apply the same logic to a field extraction? I tried .../g,/.../g, (?g)..., none of these work.

[konnex · Accepted solution]

I managed to get the output I want using multiple EXTRACTs in props.conf:

EXTRACT-eventAction = \\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)
EXTRACT-eventCategory = \\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)
EXTRACT-eventLabel = \\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)
EXTRACT-eventTimestamp = \\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)
EXTRACT-adid = \\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)
EXTRACT-userid = \\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*)

I did not know you could specify an extraction with multiple expressions.

[richgalloway]

If you mean an index-time field extraction then you probably want to add MV_ADD=true to your transforms.conf file.

[konnex]

No, I am talking about field extraction configured in props.conf...

[richgalloway]

How are you doing them in props? Please share your config.

[konnex]

[aws:sqs]
KV_MODE = none
TIME_PREFIX = \"eventTimestamp\\\":\\\"
#2017-07-19T16:03:42.195Z
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%3Q%Z
MAX_TIMESTAMP_LOOKAHEAD = 24
SHOULD_LINEMERGE = False
LINE_BREAKER = ([\n\r]+)\{\"MD5
TRUNCATE = 999999
CHARSET = UTF-8

EXTRACT-eventAction,eventCategory,eventLabel,eventTimestamp,adid,userid = (?:\\"eventAction\\" ?: ?\\"(?<eventAction>(?:(?!\\").)*)|\\"eventCategory\\" ?: ?\\"(?<eventCategory>(?:(?!\\").)*)|\\"eventLabel\\" ?: ?\\"(?<eventLabel>(?:(?!\\").)*)|\\"eventTimestamp\\" ?: ?\\"(?<eventTimestamp>(?:(?!\\").)*)|\\"adid\\" ?: ?\\"(?<adid>(?:(?!\\").)*)|\\"userid\\" ?: ?\\"(?<userid>(?:(?!\\").)*))+