Splunk Search

In Extract Fields: how can you extract Multivalue Field using Regex Code?

moaf13
Path Finder

So I have this:

                    01010101 01/02/2015 4200000  U-55555555-0000  1.00 
               Q CC                100 Random Text with numbers 676
               R BB                2 Another Random Text Message 23$kjaldsf@@

      01010101 01/02/2015 4200000  U-55555555-0000  1.00 
value 1 ==>(Q) CC                100 Random Text with numbers 676
value 2 ==>(R) BB                2 Another Random Text Message 23$kjaldsf@@

I can extract both fields using this in search Rex command _index search ....| rex field=_raw "\s(?[A-z])\s"_
returns the multivalue field i want.
However if i use the same regex during Extract field, it only takes the first value "Q" not the second one. So how can i extract multivalue field using Extract Field option. Let me know if that is even possible, if it is please let me know how?

this is how i wanted it to be

otherField       WantedField        Date                   AnotherField              AnotherMultiValueField ....etc
01010101                 Q          01/02/2015              U-5555555-0000                        CC
                         R                                                                        BB 
Tags (2)
0 Karma
1 Solution

moaf13
Path Finder

I was able to find out the answer, it can be done in Tranforms.config or the rex pipe in search head.

View solution in original post

0 Karma

moaf13
Path Finder

I was able to find out the answer, it can be done in Tranforms.config or the rex pipe in search head.

0 Karma
Get Updates on the Splunk Community!

See Splunk Platform & Observability Innovations at Cisco Live EMEA

Hi Splunkers, Learn about what’s next for Splunk Platform at Cisco Live EMEA.  Data silos are a big challenge ...

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...