Using sourcetype="localapache", extracting fields from the following event only recognizes somevalues but not somevalues2:
::1 - - 2014-10-03 16:10:27.444 Pacific Daylight Time 80 "GET /blah?wp={somevalues}&wp={somevalues2}&more={someother} HTTP/1.1" "-" 204 - "-" 1000
I'm doing the following:
sourcetype="localapache" source=access "GET /blah" | fields + wp | rex fields = wp "{...(?<something>...}" | table wp, something
Both the names of the pair is "wp". Is there any workaround for this?
(Edited some formatting problems with amp,gt,lt, etc.)
Try this
sourcetype="localapache" source=access "GET /blah" | rex field=wp max_match=0 "wp=(?<something>\w+)" | table something
Got your point. Yes, "wp" will be "somevalues" assuming that "something" is "\w+". But this, I would need to rewrite the regex to parse the query strings case by case rather than rely on the existing auto field extraction to treat multivalue cases which is useful if you don't know the fields and presumed values. I was thinking there might be a workaround to do that with "fields + wp" (also for performance).
Remove field=wp from above and try again.
I did try max_match=0 but it didn't work for me.