Splunk Search

Regex tokenizer when the multivalue field has values within an event that are not always connected in a structured way?

Path Finder

I want to make my DATASET field a multivalue field.

The regex extracting the field using Splunkweb's Field Extraction Manager page is:


The dataset values in an event are not delimited in an structured way.

An example event with 4 DATASET values:



  • How should define my regex tokenizer for the DATASET field?
  • Should I define tokenizer in fields.conf or in Splunkweb's Transform Manager page?
Tags (2)
0 Karma

Splunk Employee
Splunk Employee

There is no manager for that.

you can test is with that in a search

<my search> | makemv tokenizer="([^,].*)" DATASET

then deploy a fields.conf to make it automatic
see http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

0 Karma