How to manage multiple regex using same field name

[att35]

We have application data coming from Apache Tomcat's and have a regex in place to extract exception name. But there are some tomcats sending data in a slightly different formats and the extraction doesn't work for them. 

I have updated regex ready for these different formats, but want to keep the field name same, i.e. exception.

How Do I manage multiple extractions against the same sourcetype while keeping the field names same? If I add these regex in transforms, would they end up conflicting with each other? 

Or should I be creating them into different fields, such as exception1, exception2 and then use coalesce to eventually merge them into a single field?

[ITWhisperer]

If you can establish sufficiently unique anchors in your regex, you might be able to use pipe-delimited options e.g.

(anchor 1|anchor 2|anchor 3)(?<field>field pattern)

[gcusello · Accepted solution]

Hi @att35,

I usually use the different names and coalesce solution in a calculated field.

Ciao.

Giuseppe

[gcusello]

Hi @att35 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉