Field extraction of multi-line event with header

[ricotries]

I have a script for Linux that executes "sar -n DEV" and formats the output to look like:

Linux <kernel version> (<hostname>)  <date>   <arch>   (<#> CPU)
Average:        <interface>   <field1>   <field2>   <field3>
Average:        <interface>   <field1>   <field2>   <field3>
Average:        <interface>   <field1>   <field2>   <field3>

Using Splunk Web's field extractor, I have a regex that applies field extraction to the first "Average:" line. How do I make it so the field is applied to as many "Average:" lines exist?

[to4kawa · Accepted solution]

| makeresults
| eval _raw="
 Linux <kernel version> (<hostname>)  <date>   <arch>   (<#> CPU)
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>
 Average:        <interface>   <field1>   <field2>   <field3>"
| rex max_match=0 "(?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)"

try REGEX option (?ms) and max_match

transforms.conf

[your stanza]
REGEX  = (?ms)Average:\s+(?<interface>\S+)\s+(?<field1>\S+)\s+(?<field2>\S+)\s+(?<field3>\S+)
MV_ADD = true

I haven't try this. how about this?

[ricotries]

Would I have to make one REPORT entry per field or can I combine them all into one if I try to do this as a search-time extraction? I saw a key in transforms.conf that could apply for what I'm trying to do (MV_ADD).

[to4kawa]

yes, REGEX and MV_ADD is. my answer is updated.