Splunk Search

How do I make a field extraction that selects only the first occurrence?

Motivator

Hello,
I have events that span multiple lines. One such event looks as follows:

...
# User details
ID: 123
Username: admin
Group: admin
Group: bin
...

Each event has at least one Group line.

I want to create a field extraction for the first occurence of Group.

So, for the example above the extracted field should have the value admin.

How do I create such a field extraction?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

| rex Group:\s(?<group>\w+)\n+

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this

| rex Group:\s(?<group>\w+)\n+

View solution in original post

0 Karma

Motivator

Thank you for your answer!
When I test your regex then I see there are two match objects:
https://regex101.com/r/lQXqFx/1
How will Splunk behave in this case?

0 Karma

SplunkTrust
SplunkTrust

It's working off that \n+ added at the end, saying grab only the first match. If this answered your question, please accept it and close it out

0 Karma

Influencer

try this in splunk with the rex command its working

0 Karma

Motivator

It is working.
However, I cannot find any documentation as to Splunk handles multiple match objects.

0 Karma

Influencer

by default its matching ungreedy, and if you want it to be global you can add flaggs.

I am not sure if there is any doc on that.

0 Karma