Splunk Search
Highlighted

Multivalue field regex question

Builder

I have a field like this:

... group="Group One,Group2,Some Other Group" ...

Using 'makemv delim="," group' is easy and works great, but I'm having a hard time getting the right regex in transforms to do it automatically. I've tried a number of things, but they all end up being too greedy, or just not working. Based on my last question here, I tried things like this:

REGEX = (?:(?:group=\")|(?:,))(?<group>(?:[^,]+)*)
MV_ADD = true

I've also tried:

REGEX = (([^,]+)*)
SOURCE_KEY = group

I've tried enough things that I've lost track. I'm sure this should be quite easy, but it's not. Any help?

Tags (2)
0 Karma
Highlighted

Re: Multivalue field regex question

Builder

Fiddled with it for a little while, but didn't get too much farther. I added some ingredients like positive lookahead (?=) and non-greedy wildcard (.*?). Taking a step back, I'm not sure if regex is the right way to go about this. Isn't there an easier way to persist "makemv delim=" to the configs? If not, there should be.

(?=group=\")(?:(?:group=\")|(?:.*,))(?<group>[^,]*?)(?:\")
Highlighted

Re: Multivalue field regex question

Builder

That does seem to work a bit better, but still seems unreliable. I have a couple fields like this and it seems to work with my group data, but not with my site data which is formatted the same and I would expect would work properly with the same regex. Agreed. I have to think there's something built-in that I've missed here. Would be really nice if this worked in this case, but it doesn't seem to or I've missed something:

DELIMS = "," 
SOURCE_KEY = group 
MV_ADD = true
0 Karma
Highlighted

Re: Multivalue field regex question

Champion

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

View solution in original post

Highlighted

Re: Multivalue field regex question

Communicator

Challenge bonus extra credit question: What should my transforms.conf regex look like for the same line of data mw specified, but without the quotation marks? Betcha can't do it.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.