Splunk Search

Multiple matches in search-time transforms

pehlke
Splunk Employee
Splunk Employee

I have syslog-ng statistics logs that look like this:

May 13 09:13:01 s_internal@syslog-ng.example.com syslog-ng[32246]: Log statistics; processed='src.internal(s_local#2)=1', stamp='src.internal(s_local#2)=1305302462', processed='destination(d_splunk_unix)=226159', processed='destination(d_arcsight_ciscopixfile)=525439', processed='destination(d_spooler)=0', processed='destination(d_syslog1)=96361', processed='destination(d_secure)=47174', processed='src.internal(s_internal#0)=16', stamp='src.internal(s_internal#0)=1305303121', processed='destination(d_log_juniper)=2246', processed='destination(d_arcsight_ciscoacs)=438', processed='destination(d_snarefile)=1121851', processed='destination(d_arcsight_unix)=393237', processed='destination(d_bootlog)=222057', processed='destination(d_messages)=3611829', processed='global(payload_reallocs)=33', processed='destination(d_arcsight_proxysg)=3659', processed='destination(d_cron)=109', dropped='dst.tcp(d_syslog1#0,10.29.76.97:8514)=0', processed='dst.tcp(d_syslog1#0,10.29.76.97:8514)=96361', stored='dst.tcp(d_syslog1#0,10.29.76.97:8514)=0', processed='destination(d_arcsight_asafile)=458816', processed='destination(d_arcsight_netscreen_fwvpnfile)=385498', processed='destination(d_maillog)=5', processed='destination(d_console)=0', processed='source(s_net)=3515468', processed='global(sdata_updates)=0', processed='destination(d_splunk_osiris)=2708', processed='destination(d_arcsight_ciscofwsmfile)=483202', processed='source(s_local)=96475', processed='source(s_internal)=16', processed='destination(d_arcsight_ironport)=136042', processed='center(queued)=0', processed='destination(d_syslognglog)=16', processed='destination(d_junk_file)=247985', processed='destination(d_splunk_snare)=1139637', processed='destination(d_arcsight_amp)=0', processed='global(msg_clones)=0', processed='center(received)=0'

I want to extract the various d_* destinations and their values. I have a regex in transforms.conf that matches, but only extracts the first destination (here, d_splunk_unix=226159). I see that REPEAT_MATCH exists, but only applies to index-time field extractions.

Is there a transforms.conf analog of, say, rex max_match=100 for search-time extractions?

Thanks

0 Karma
1 Solution

southeringtonp
Motivator

Yes. For search-time, use:

MV_ADD = True

View solution in original post

southeringtonp
Motivator

Yes. For search-time, use:

MV_ADD = True

pehlke
Splunk Employee
Splunk Employee

Ah, perfect. Thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...