If I'm trying to regex InteractionID and msg below, how do I get the results for all InteractionID and msg within the same transactionID?
Log example:
transactionID=888999;InteractionID=123;msg=hello;...;InteractionID=456;msg=world;...
transactionID=000011;InteractionID=789;msg=foo;...;InteractionID=556;msg=test;...
... means texts
InteractionID field should contain 123, 456, 789, 556
msg field should contain hello, world, foo, test
Like this:
| makeresults
| eval _raw="transactionID=888999;InteractionID=123;msg=hello;...;InteractionID=456;msg=world;..."
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| rex max_match=0 "InteractionID=(?<InteractionID>\d+);msg=(?<msg>[^;]+)"
Give this a try : | makemv tokenizer="msg=([^;]+);?" _raw
Here is the example i used to test it:
| makeresults
| eval _raw="transactionID=888999;InteractionID=123;msg=hello;...;InteractionID=456;msg=world;..."
| extract
| makemv tokenizer="msg=([^;]+);?" _raw
I hope this solves your problem