Is it possible to use max_match inside a datamodel rex definition?

[tonniea]

In the definition of a datamodel, I would like to use a regular expression with argument max_match=10 or max_match=0. In the datamodel editor this doesn't seem to be possible.

Any thoughts?

[xpac · Accepted solution]

Reposting the comment of @tonniea so it doesn't get lost 🙂

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.

[monteiroh]

did u get this to work?

[tomaszwrona]

Hi,

i have tried this approach, changed multivalve to true and restarted Splunk. Sadly it didn't work in 7.2.6.
Is there something different? How else can I put into data model regular expression fields with max_match=0?

Best regards
Tomasz

[xpac]

Without trying - the datamodels are saved as a file, maybe you can try to manually manipulate/add that setting there?

[tonniea]

Thanks for the hint. In the JSON export I found a multivalue option that I'm going to try. Too bad this isn't accessible via the editor.

[xpac]

Good to know. Now that you have the details at hand, you could post an answer to your own question so others Googling for it can profit of your experience 😉

[tonniea]

Yep, sure...

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.