Splunk Search

How to extract all matching values from an event using regex

john
Communicator

Hi,

iam trying to extract certain values from my log files which i have given below
1st event
at x.x.x.x.x.x(1)
at x.x.x.x.x.x.x.x(2)
at X.x.x.x.x.x.x.x.xx(3)
...........
2nd event
at x.x.x.x.x.x(4)
at x.x.x.x.x.x.x.x(5)
at X.x.x.x.x.x.x.x.xx(6)
...............
.........
The issue iam facing is iam getting only first line of every event starting with "at", not the all lines in one event itself.I want all the values after "at" in each events"
the output iam getting is like this

x.x.x.x.x.x(1)
x.x.x.x.x.x.x.x(5)

This is the regex iam using

rex field=_raw "at\s(?.*)\s"

Tags (1)
1 Solution

Ayn
Legend

rex only matches one time by default. This behaviour is controlled by the max_match parameter, so if you want more matches just set it to something higher:

... | rex max_match=10 field=_raw "at\s(?<value>.*?)\s"

View solution in original post

Ayn
Legend

rex only matches one time by default. This behaviour is controlled by the max_match parameter, so if you want more matches just set it to something higher:

... | rex max_match=10 field=_raw "at\s(?<value>.*?)\s"

john
Communicator

Thanks Ayn,Its working fine..........

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...