Splunk Search

How to create a regular expression on a multivalue field

jlkokko
Path Finder

I have a multivalue (MV) field "filetypes" with values such as:

test/Makefile.am,test/och_test.cc,test/fully1.py,24,FKP/pro.pl

I need to keep only the extension listed (such as am, cc, py, pl, etc..) so I have two questions:

A. The appropriate regular expression
B. Is it more appropriate to run a regex prior splitting a MV field or after?

1 Solution

somesoni2
Revered Legend

Try like this. It'll create a new field with just the extn.

your base search with file filetype
| rex field=filetypes max_match=0 "(?<extns>\.\w+)"

View solution in original post

jlkokko
Path Finder

Both of the above worked well...wondering if one less expensive than the other

0 Karma

woodcock
Esteemed Legend

Like this:

... | mvexpand filetypes | rex field=filetypes "^(?<file_prefix>.+)\.(?<file_suffix>[^\.]+)$"

woodcock
Esteemed Legend

Mine was geared towards enabling the later commands that you will surely be interested in doing. You can look at the Job Inspector to compare efficiencies.

0 Karma

somesoni2
Revered Legend

Try like this. It'll create a new field with just the extn.

your base search with file filetype
| rex field=filetypes max_match=0 "(?<extns>\.\w+)"
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...