Splunk Search

Is it possible to use max_match inside a datamodel rex definition?

tonniea
Explorer

In the definition of a datamodel, I would like to use a regular expression with argument max_match=10 or max_match=0. In the datamodel editor this doesn't seem to be possible.

Any thoughts?

Tags (1)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

Reposting the comment of @tonniea so it doesn't get lost :slightly_smiling_face:

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.

View solution in original post

0 Karma

xpac
SplunkTrust
SplunkTrust

Reposting the comment of @tonniea so it doesn't get lost :slightly_smiling_face:

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.
0 Karma

monteiroh
Explorer

did u get this to work?

0 Karma

tomaszwrona
Explorer

Hi,

i have tried this approach, changed multivalve to true and restarted Splunk. Sadly it didn't work in 7.2.6.
Is there something different? How else can I put into data model regular expression fields with max_match=0?

Best regards
Tomasz

0 Karma

xpac
SplunkTrust
SplunkTrust

Without trying - the datamodels are saved as a file, maybe you can try to manually manipulate/add that setting there?

tonniea
Explorer

Thanks for the hint. In the JSON export I found a multivalue option that I'm going to try. Too bad this isn't accessible via the editor.

0 Karma

xpac
SplunkTrust
SplunkTrust

Good to know. Now that you have the details at hand, you could post an answer to your own question so others Googling for it can profit of your experience :winking_face:

0 Karma

tonniea
Explorer

Yep, sure...

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...