REX not working in props.conf

[hartfoml]

I am using this rex command

| rex max_match=100 "(?i)<severity>(?P<Severity>[^<]+)"

When I add this to the props.conf like this

EXTRACT-Severity = max_match=100 (?i)<severity>(?P<Severity>[^<]+)

I get no return at all

If I use this in the props.conf

EXTRACT-Severity = (?i)<severity>(?P<Severity>[^<]+)

I only get the first return in the event not all the other possible returns in the event

Can anyone help with this rex conversion to props.conf

[joshd · Accepted solution]

props.conf wont understand the max_match parameter, that is specific to the rex command... so you cannot use it there.

Now what do you mean you only get the first return in the event and not all other possible returns? Do you mean in a single event there are multiple Severity levels that could be reported?

If so you could look at using a transform for this...

in transforms.conf :

[get_severity]
REGEX = \<severity\>([^<]+)
FORMAT = Severity::$1
MV_ADD = true

then add in props.conf :

REPORT-severity = get_severity

[Ayn]

All this stuff is well explained in the docs.

http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf

[smolcj]

can u explain the option FORMAT.. how to define that if we have more than one multivalued fields to extract from one event
thank you