Help with regex needed

[damucka]

Hello,

I am trying to extract the system IDs from single event into the multiple events, I mean that each SID is in a separate line. I try to deploy a regex for this, without success.

Could perhaps anyone help with the below?

Kind Regards,

Kamil

| makeresults
| eval 
SID="I32
DYR
DZ1
MHW
DYN
I58
ICZ
ICN
I69
I8Y
IAE
I6J
I71
SLG
I9Z
I7T
I7Z
I5Y
I5U
I5T
I3I
I3G
TCX
I5O
DZX
DZC
DYQ
DYO
DYM
OGO
OJ8
OK8
OKQ
OKX
DXF
DYE
DYF
SS4
QMW
I24
R9H
O67
OP0
SP9
I4I
I4M"

| rex field=SID "^(?<SID2>[^\r\n].+)"

[richgalloway · Accepted solution]

By default, the rex command returns a single match.  Use the max_match option to change that.  Then use the mvexpand command to split the field into separate events.

| rex field=SID max_match=0 "(?<SID2>.+[^\S]+)"
| mvexpand SID2

[damucka]

Unfortunately this solution does not work, still getting just the first match only

[richgalloway]

I modified the regex.  Please try the revised query.