How to get a field extraction of a field extraction within one regex?

[Marco204]

Hi there,

so I have a line of log like this:

http://some.url/path/?param=x,y,z 

So I want to extract a field "extractedParam" with the value "x,y,z".

Then I want to extract the three values into a multivalue field "mvExtractedParam".

Within Splunk Cloud I will use a field extraction with the following regex which is wrapped up by a field transformation (here I can check "Create multivalued fields").

So I try to do everything within one regex, but here I am struggling.

\?param=(?<extractedParam>.*)

This extracts "x,y,z".

Right now I dont know how to chain the next step...

All the best,
Marco

[PickleRick]

I suppose you could try to extract values from that field you've just extracted but it would need creating transform manually with source key specified as your newly extracted key. I'm not sure however how you go with webui about reordering transforms.

So you can as well just add a calculated field that splits your extractedParam into a multivalued field. I think that's more straightforward.

[Marco204 · Accepted solution]

Well, that was pretty straight forward @PickleRick 🙂

So I was able to do it within the SPL:

mainsearch | eval mvExtractedParam=split(extractedParam, ",")

And I was able to create a field transformation using "extractedParam" as the value for Source Key and the easy Regular expression:

(?<mvExtractedParam>\w+)

Thanks a lot,
Marco

PS: never forget to create a field extraction that uses the field transformation, just for the purpose of enabling it...