Splunk Search

Repeating regex to fill multivalue field

Derek
Path Finder

Ok. Not having a spectacular regex day...

I have this:

Recipients: joe.smith@mig.mydomain.com, jane.smith@mig.mydomain.com, bob.smith@mig.mydomain.com,

In props.conf I have:

[mySource]
EXTRACT-recipients = (?i)Recipients: (?P<recipients>.*, )
REPORT-to = myTo

and in transforms.conf I have:

[myTo]
REGEX = (?P<to>.*?[,])
SOURCE_KEY = recipients
MV_ADD = true

It sorta works, but I'm getting each to value twice, and how do I drop the trailing ',' at the end.

Thanks!!

Tags (1)
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can try the following definition for myTo - it should get rid of the trailing commas, however I was not able to get double values. Can you post a complete sample event and all transfroms that extract a field named 'to'?

[myTo]
REGEX = (?P<to>[^,]+)[,]
SOURCE_KEY = recipients
MV_ADD = true

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can try the following definition for myTo - it should get rid of the trailing commas, however I was not able to get double values. Can you post a complete sample event and all transfroms that extract a field named 'to'?

[myTo]
REGEX = (?P<to>[^,]+)[,]
SOURCE_KEY = recipients
MV_ADD = true

Derek
Path Finder

The regex worked great. Thanks! I sorted out the issue with the duplicates. It was the way I was using extract to reload my props/transforms.

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...