Splunk Search

Is it possible to use max_match inside a datamodel rex definition?

tonniea
Explorer

In the definition of a datamodel, I would like to use a regular expression with argument max_match=10 or max_match=0. In the datamodel editor this doesn't seem to be possible.

Any thoughts?

Tags (1)
0 Karma
1 Solution

xpac
SplunkTrust
SplunkTrust

Reposting the comment of @tonniea so it doesn't get lost 🙂

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.

View solution in original post

0 Karma

xpac
SplunkTrust
SplunkTrust

Reposting the comment of @tonniea so it doesn't get lost 🙂

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.
0 Karma

monteiroh
Explorer

did u get this to work?

0 Karma

tomaszwrona
Explorer

Hi,

i have tried this approach, changed multivalve to true and restarted Splunk. Sadly it didn't work in 7.2.6.
Is there something different? How else can I put into data model regular expression fields with max_match=0?

Best regards
Tomasz

0 Karma

xpac
SplunkTrust
SplunkTrust

Without trying - the datamodels are saved as a file, maybe you can try to manually manipulate/add that setting there?

tonniea
Explorer

Thanks for the hint. In the JSON export I found a multivalue option that I'm going to try. Too bad this isn't accessible via the editor.

0 Karma

xpac
SplunkTrust
SplunkTrust

Good to know. Now that you have the details at hand, you could post an answer to your own question so others Googling for it can profit of your experience 😉

0 Karma

tonniea
Explorer

Yep, sure...

In the field definition of the datamodel for your rex field you find this:

"calculationType":"Rex","expression":"(?[^<]?)<"},{"outputFields":[{"fieldName":"cpu_load","owner":"cpu2","type":"string","fieldSearch":"","required":false,"multivalue":false*,"hidden":false...etc

If you change the "multivalue" attribute to true, import the datamodel and restart Splunk this appears to be working as intended.

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...