Splunk Search

RegEx extract multiple values per field

Path Finder

I am right now trying to reed Lotus Notes (to be coorect: Domincos console.log-file) Events. One of my problems I have, is the following:
(its not connected to Notes especially, but people should know, that at least someone tried it.)

Sometime I have an ID, but it can occur once, or comma separated twice. What can I do to get this value into two values for one field (I am using the search-time extraction).
...[%Timestamp%] Message ABC123 delivered....
...[%Timestamp%] Message ABC129,ABC130 delivered....

My current RegEx extraction for the field is:
... (?P[\dA-Z]+) ...//some other fields exist before and afterwards

but how can I make it detect things twice.. ?

Thanks for your support!


Tags (2)
0 Karma



I think you may have several solutions. I'd like to explain my idea.

I will change regex configuration.

... (?P<messageid>[0-9A-Z,]+) ...

And I will add the following search commands after your search command.

<your search> | makemv delim="," messageid 

The field "messageid" will be multiple value field if it has 2 and more contents.

And if you add "| mvexpand messageid", you will get 2 events; ABC129, ABC130.

I hope it helps you.

Thank you.

0 Karma

Path Finder

Hey, that sounds interesting. I'll give it a try. mvexpand does only split the event into two, as soon as I search for it, correct?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...