Splunk Search

How to extract fields at search-time from a multivalue query string?

New Member

Using sourcetype="localapache", extracting fields from the following event only recognizes somevalues but not somevalues2:

::1 - - 2014-10-03 16:10:27.444 Pacific Daylight Time 80 "GET /blah?wp={somevalues}&wp={somevalues2}&more={someother} HTTP/1.1" "-" 204 - "-" 1000

I'm doing the following:
sourcetype="localapache" source=access "GET /blah" | fields + wp | rex fields = wp "{...(?<something>...}" | table wp, something

Both the names of the pair is "wp". Is there any workaround for this?

(Edited some formatting problems with amp,gt,lt, etc.)

0 Karma

SplunkTrust
SplunkTrust

Try this

sourcetype="localapache" source=access "GET /blah"  | rex field=wp max_match=0 "wp=(?<something>\w+)" | table something
0 Karma

New Member

Got your point. Yes, "wp" will be "somevalues" assuming that "something" is "\w+". But this, I would need to rewrite the regex to parse the query strings case by case rather than rely on the existing auto field extraction to treat multivalue cases which is useful if you don't know the fields and presumed values. I was thinking there might be a workaround to do that with "fields + wp" (also for performance).

0 Karma

SplunkTrust
SplunkTrust

Remove field=wp from above and try again.

0 Karma

New Member

I did try max_match=0 but it didn't work for me.

0 Karma