How do I save my rex statement as a field extraction?

[ifeldshteyn]

I have an extraction that retrieves all the error_reason's in a long string that are separated by a substring err_sep

Example long_error_string:

"Blah blah blah error_reason=divided by zero err_sep error_reason=#num is bad$$$ err_sep error_reason=Infinite loop! err_sep"

This regex works perfectly and creates multiple error_reasons.

| rex field=long_error_string "error_reason=(?P<error_reason>.*?)err_sep" max_match=9999

I was wondering if I can replicate the same behavior using Splunk's field extraction. Without the max_match, it only gets one result and I want to get them all. I am guessing I am missing some simple setting.

Thanks.

[somesoni2]

If you're looking for saving this field extraction, see below link

http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Managefieldtransforms#Review_and_update_se...

[ifeldshteyn]

Oh I see that there is a "create multivalue button" in transforms. I'll try that out - thanks!