Splunk Search

Need some help with a repeating regex

mw
Splunk Employee
Splunk Employee

I have an event with a field like this: ids="ID-120-1, ID-141-5, ID-92-5, N/A"

I'd like to extract the field and only keep IDs (i.e. I don't want the "N/A" value).

I have a transforms entry like this:

[mv-ids]
REGEX = \bid=\"(?<id>(ID-\d+-\d+)+)
MV_ADD = true

and my props.conf

[mysourcetype]
REPORT-ids = mv-ids

This isn't working as I would hope though. I'm only getting the first ID. What do I need to do to get all of the IDs added to the id field?

Tags (2)
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee
0 Karma

mw
Splunk Employee
Splunk Employee
0 Karma

jamesdon
Path Finder

I don't think you need the last plus sign.

Try:

REGEX = \bid=\"(?<id>(ID-\d+-\d+))
FORMAT = mv-id::$1

Jim

0 Karma

mw
Splunk Employee
Splunk Employee

That doesn't seem to work. I end up with 1 entry in the field and it's the entire string. Oh, I was so hopeful. I'm about to put my head through a wall. 🙂

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...