I have an extraction that retrieves all the error_reason's in a long string that are separated by a substring err_sep
"Blah blah blah error_reason=divided by zero err_sep error_reason=#num is bad$$$ err_sep error_reason=Infinite loop! err_sep"
This regex works perfectly and creates multiple error_reasons.
| rex field=long_error_string "error_reason=(?P<error_reason>.*?)err_sep" max_match=9999
I was wondering if I can replicate the same behavior using Splunk's field extraction. Without the max_match, it only gets one result and I want to get them all. I am guessing I am missing some simple setting.