Splunk Search

Multiple Values per Event - transforms.conf regex

lohans
Explorer

I am trying to pick out all the Email addresses from the sample data below:

USER:Peter Pan
EMAIL:email@email.com
EMAIL:email1@email.com
EMAIL:email2@email.com
EMAIL:email3@email.com
EMAIL:email4@email.com
EMAIL:email5@email.com
USER:Bob Scott
EMAIL:email@email.com
EMAIL:email1@email.com
EMAIL:email2@email.com
EMAIL:email3@email.com
EMAIL:email4@email.com
EMAIL:email5@email.com
USER:Tomas Uncle
EMAIL:email@email.com
EMAIL:email1@email.com
EMAIL:email2@email.com
EMAIL:email3@email.com
EMAIL:email4@email.com
EMAIL:email5@email.com

Now this regex with rex works fine and picks up all the email addresses

rex field=_raw max_match=15 "EMAIL:(?<test>.*?)\n"

But how do i specify in transforms.conf to match multiple times??

There is no max_match option for transforms.conf
Here is my transforms.conf

[get-emails]
REGEX = ^EMAIL:(.*?)\n
FORMAT = Emails::$1

As you can see i tried both types of supported regex's in the transforms.conf file.

Any ideas?

1 Solution

ziegfried
Influencer

You can use the MV_ADD option in your transforms stanza:

[get-emails]
REGEX = EMAIL:(\S+)
FORMAT = Emails::$1
MV_ADD = true

View solution in original post

ziegfried
Influencer

You can use the MV_ADD option in your transforms stanza:

[get-emails]
REGEX = EMAIL:(\S+)
FORMAT = Emails::$1
MV_ADD = true

lohans
Explorer

Now that was easy! Thanks a million! 😉

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...