Splunk Search

Multivalue field regex question

mw
Splunk Employee
Splunk Employee

I have a field like this:

... group="Group One,Group2,Some Other Group" ...

Using 'makemv delim="," group' is easy and works great, but I'm having a hard time getting the right regex in transforms to do it automatically. I've tried a number of things, but they all end up being too greedy, or just not working. Based on my last question here, I tried things like this:

REGEX = (?:(?:group=\")|(?:,))(?<group>(?:[^,]+)*)
MV_ADD = true

I've also tried:

REGEX = (([^,]+)*)
SOURCE_KEY = group

I've tried enough things that I've lost track. I'm sure this should be quite easy, but it's not. Any help?

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

View solution in original post

araitz
Splunk Employee
Splunk Employee

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

blurblebot
Communicator

Challenge bonus extra credit question: What should my transforms.conf regex look like for the same line of data mw specified, but without the quotation marks? Betcha can't do it.

0 Karma

Dan
Splunk Employee
Splunk Employee

Fiddled with it for a little while, but didn't get too much farther. I added some ingredients like positive lookahead (?=) and non-greedy wildcard (.*?). Taking a step back, I'm not sure if regex is the right way to go about this. Isn't there an easier way to persist "makemv delim=" to the configs? If not, there should be.

(?=group=\")(?:(?:group=\")|(?:.*,))(?<group>[^,]*?)(?:\")

mw
Splunk Employee
Splunk Employee

That does seem to work a bit better, but still seems unreliable. I have a couple fields like this and it seems to work with my group data, but not with my site data which is formatted the same and I would expect would work properly with the same regex. Agreed. I have to think there's something built-in that I've missed here. Would be really nice if this worked in this case, but it doesn't seem to or I've missed something:

DELIMS = "," 
SOURCE_KEY = group 
MV_ADD = true
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...