How can regex extract multiple values?

[dbcase]

Hi,

I have the below data and query (with Regex), what I'd like to have the Regex do is extract ALL occurrences of MAC and RSSI values. Is there any way it can do that?

index="camera_status" sourcetype=access_combined_camerastatus|rex "Premise=\s+(?<premiseid>\d+)"|rex "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex "RSSI=\s+(?<rssiid>-\d+)"|where rssiid!=0|table premiseid, macid, rssiid

Premise= 434268
Name= Rawr
    IP= 172.16.12.103
    ID= 4
    Mac= 78:94:B4:FF:7F:C4
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI= -45 dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
    MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
Name= SammyCam
    IP= 172.16.12.100
    ID= 2
    Mac= B4:A5:EF:E7:21:91
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI= -45 dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= https://172.16.12.100:80/openhome/streaming/channels/0/flv
    MJPEG URL= https://172.16.12.100:80/openhome/streaming/channels/2/mjpeg
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
Name= Unicorn Zombie Apocalypse
    IP= 172.16.12.102
    ID= 5
    Mac= 78:94:B4:FF:7F:BF
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI=  dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= 
    MJPEG URL= 
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720

[wrangler2x]

A small tweak to your capture expression...

|rex max_match=0 field=foo "Mac=\s+(?<macid>[^\n\s]+)"
|rex max_match=0 field=foo "RSSI=\s+(?<rssiid>[^\n\s]+)"

Adding the - in there causes it to miss the third RSSI value, which has no hyphen. These stop on whitespace or end of line.

[MuS · Accepted solution]

Hi dbcase,

add max_match=0 to all rex like

|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"

Hope this helps ...

cheers, MuS