Splunk Search

Need some help with a repeating regex

mw
Splunk Employee
Splunk Employee

I have an event with a field like this: ids="ID-120-1, ID-141-5, ID-92-5, N/A"

I'd like to extract the field and only keep IDs (i.e. I don't want the "N/A" value).

I have a transforms entry like this:

[mv-ids]
REGEX = \bid=\"(?<id>(ID-\d+-\d+)+)
MV_ADD = true

and my props.conf

[mysourcetype]
REPORT-ids = mv-ids

This isn't working as I would hope though. I'm only getting the first ID. What do I need to do to get all of the IDs added to the id field?

Tags (2)
0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee
0 Karma

mw
Splunk Employee
Splunk Employee
0 Karma

jamesdon
Path Finder

I don't think you need the last plus sign.

Try:

REGEX = \bid=\"(?<id>(ID-\d+-\d+))
FORMAT = mv-id::$1

Jim

0 Karma

mw
Splunk Employee
Splunk Employee

That doesn't seem to work. I end up with 1 entry in the field and it's the entire string. Oh, I was so hopeful. I'm about to put my head through a wall. 🙂

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...