Repeating regular expression

[clymbouris]

I have an Access List input that looks like this

"|ALLOW-LABS.LOCAL\Accounting_FS_Access-0x1301ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|0=WriteOwner|0=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read|
|ALLOW-LABS.LOCAL\FS_Admin-0x1f01ff-OI|CI|0=GenericRead|0=GenericWrite|0=GenericExecute|0=GenericAll|0=SystemSecurity|1=Synchronize|1=WriteOwner|1=WriteDAC|1=ReadControl|1=Delete|1=WriteAttributes|1=ReadAttributes|1=DeleteChild|1=Execute|1=WriteEA|1=ReadEA|1=Append|1=Write|1=Read|"

This comes as one event in Splunk and anything after |ALLOW is repeated as many times as there are groups defined in the ACL (so unknown number of repeats).

What I'd like to achieve is to extract and format the results in a way that groups are separated from each other.

___ROW1___
Group = LABS.LOCAL\Accounting_FS_Access
GenericRead = 0
GenericWrite = 0
...
Read=1

___ROW2___
Group = LABS.LOCAL\FS_Admin
GenericRead=1
GenericWrite=1
...
Read=1

...
___ROW7___
Group = aGroup
...

I can hit the results by repeating the regex but the output is not the one desired since I'm having multiple Group fields in the event. What I'd like is for a way to separate Group1, Group2, Group3.

rex max_match=99 field=ACL  "\|(ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])\=GenericRead\|(?<SACL_Fail_GenericWrite>[01])\=GenericWrite\|(?<SACL_Fail_GenericExecute>[01])\=GenericExecute\|(?<SACL_Fail_GenericAll>[01])\=GenericAll\|......\|ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])..."

Maybe I'm going the wrong way about this? I've been going around this for days. Any help would be much appreciated.

[richgalloway]

When you use a max_match value other than 1 your matching fields will be multi-valued. Use the mvexpand command to separate the results into mutliple fields.

I modified your regex string slightly to work with your sample data in regex101.com.

\|(?:ALLOW-(?<Group>.*?)-\w+-\w{2}|\w{2}\|(?<SACL_Fail_GenericRead>[01])\=GenericRead\|(?<SACL_Fail_GenericWrite>[01])\=GenericWrite\|(?<SACL_Fail_GenericExecute>[01])\=GenericExecute\|(?<SACL_Fail_GenericAll>[01])\=GenericAll\|...)*