I have scenario where my field value is pipe delimited
if in search I do table of Session, it extracts only first value i.e. PP|.
...search | table Session
How to extract whole value? Appreciate immediate help and reason behind the behavior.
... | rex "Session=(?<Session>[^,\s]+)" ... | makemv delim="|" Session
And possibly after that (it depends on whether you need each value to be its own event):
... | mvexpand Session
I am assuming that in your log the data will exist as
Session=PP|OO|GG<space>. In such case you can follow:
To extract all values intact with pipes from scratch
_raw try this:
your query to return the events | rex field=_raw "Session=(?<newSession>[\S]+)" | table newSession
If you need the individual values then you can try this query which includes one given by @woodcock:
your query to return the events | rex field=_raw "Session=(?<newSession>[\S]+)" | makemv delim="|" newSession | mvexpand newSession
Thanks for answer, but my requirement is to capture all of it at same time as complete value.
e.g. ..| table Session -> should return "PP|OO|GG".
I think makemv will break whole value in array of values based on '|' delimiter, but I want to print them in different rows in table.
I am trying regex only, but again regex is having few problems in my case, as log msg is bit volatile in format.
Is there no way to have value as whole i.e. "PP|OO|GG"? and why does splunk is picking only first value??