Splunk Search

Regex tokenizer when the multivalue field has values within an event that are not always connected in a structured way?

boris
Path Finder

I want to make my DATASET field a multivalue field.

The regex extracting the field using Splunkweb's Field Extraction Manager page is:

(umi\.|%3D|,|%3B|\=|/catalog/w+/)(?P{DATASET}[a-z0-9_\-%]+)\.(geometry|\w*geom|\w+\.\w+)

The dataset values in an event are not delimited in an structured way.

An example event with 4 DATASET values:

"select=VALUE1,umi.VALUE2&from=VALUE3%BVALUE4.gemetry"

QUESTIONS:

  • How should define my regex tokenizer for the DATASET field?
  • Should I define tokenizer in fields.conf or in Splunkweb's Transform Manager page?
Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

There is no manager for that.

you can test is with that in a search

<my search> | makemv tokenizer="([^,].*)" DATASET

then deploy a fields.conf to make it automatic
see http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...