Rex not iterating over large string

[evan_roggenkamp]

I am trying to use rex to extract the hostnames and put them in a table, but rex is only matching the first string and then it stops

rex "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name

The data is part of a job log I am ingesting files and directories input.

The textfile is formatted like this:

___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.mrcl1.domain.net (10.140.255.7):
 ERROR: Cannot download Running config : Connection Refused by 10.140.255.7
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.abvl1.domain.net (10.252.255.50):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.blvw1.domain.net (10.196.255.5):
downloaded Running config
__________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.clem1.domain.net (10.196.255.1):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.domain.net (10.140.255.9):
downloaded Running config
___________________________________________________________________________
HOSTNAME: HOST-ASR9001-Aggr1.drck1.domain.net (10.132.255.3):
downloaded Running config
___________________________________________________________________________

I did have to clean this file up with python before getting it into splunk, so if some kind of text operation/reorganization would help this go more smoothly that is definitely an option.

[gcusello]

try this

HOSTNAME:\s+(?<myfield>[^ ]+)/g

you can test it on https://regex101.com/
Bye.
Giuseppe

[somesoni2 · Accepted solution]

The rex command by default matches only one. Use max_matchoption to increase that limit

 ...| rex max_match=100 "(HOSTNAME: )(?<node_name>.*)\s\(" | table node_name