Splunk Search

How can regex extract multiple values?

dbcase
Motivator

Hi,

I have the below data and query (with Regex), what I'd like to have the Regex do is extract ALL occurrences of MAC and RSSI values. Is there any way it can do that?

index="camera_status" sourcetype=access_combined_camerastatus|rex "Premise=\s+(?<premiseid>\d+)"|rex "Mac=\s+(?<macid>[a-fA-F0-9\.:-]{12,17})"|rex "RSSI=\s+(?<rssiid>-\d+)"|where rssiid!=0|table premiseid, macid, rssiid

Premise= 434268
Name= Rawr
    IP= 172.16.12.103
    ID= 4
    Mac= 78:94:B4:FF:7F:C4
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI= -45 dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= https://172.16.12.103:80/openhome/streaming/channels/0/flv
    MJPEG URL= https://172.16.12.103:80/openhome/streaming/channels/2/mjpeg
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
Name= SammyCam
    IP= 172.16.12.100
    ID= 2
    Mac= B4:A5:EF:E7:21:91
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI= -45 dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= https://172.16.12.100:80/openhome/streaming/channels/0/flv
    MJPEG URL= https://172.16.12.100:80/openhome/streaming/channels/2/mjpeg
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
Name= Unicorn Zombie Apocalypse
    IP= 172.16.12.102
    ID= 5
    Mac= 78:94:B4:FF:7F:BF
    FW Ver= 3.0.02.51
    Manufacturer= iControl
    Model= iCamera2-C
    Video Size= LARGE
    Verified= true
    RSSI=  dB
    Supported Video Formats= [MJPEG, FLV, RTSP]
    Supported Video Codecs= [H264, MPEG4]
    FLV URL= 
    MJPEG URL= 
    API Version= 3.3
    MotionTurnedOn= false
    Local Video Aspect Ratio= 16:9
    Local Video Resolution= 1280:720
    Remote Video Aspect Ratio= 16:9
    Remote Video Resolution= 1280:720
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi dbcase,

add max_match=0 to all rex like

|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"

Hope this helps ...

cheers, MuS

View solution in original post

wrangler2x
Motivator

A small tweak to your capture expression...

|rex max_match=0 field=foo "Mac=\s+(?<macid>[^\n\s]+)"
|rex max_match=0 field=foo "RSSI=\s+(?<rssiid>[^\n\s]+)"

Adding the - in there causes it to miss the third RSSI value, which has no hyphen. These stop on whitespace or end of line.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi dbcase,

add max_match=0 to all rex like

|rex max_match=0 "Premise=\s+(?<premiseid>\d+)"

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...