Splunk Search

How to extract all matching values from an event using regex

Communicator

Hi,

iam trying to extract certain values from my log files which i have given below
1st event
at x.x.x.x.x.x(1)
at x.x.x.x.x.x.x.x(2)
at X.x.x.x.x.x.x.x.xx(3)
...........
2nd event
at x.x.x.x.x.x(4)
at x.x.x.x.x.x.x.x(5)
at X.x.x.x.x.x.x.x.xx(6)
...............
.........
The issue iam facing is iam getting only first line of every event starting with "at", not the all lines in one event itself.I want all the values after "at" in each events"
the output iam getting is like this

x.x.x.x.x.x(1)
x.x.x.x.x.x.x.x(5)

This is the regex iam using

rex field=_raw "at\s(?.*)\s"

Tags (1)
1 Solution

Legend

rex only matches one time by default. This behaviour is controlled by the max_match parameter, so if you want more matches just set it to something higher:

... | rex max_match=10 field=_raw "at\s(?<value>.*?)\s"

View solution in original post

Legend

rex only matches one time by default. This behaviour is controlled by the max_match parameter, so if you want more matches just set it to something higher:

... | rex max_match=10 field=_raw "at\s(?<value>.*?)\s"

View solution in original post

Communicator

Thanks Ayn,Its working fine..........

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!