Splunk Search

Two multivalue fields needed

wkassel
New Member

Hi - I need to extract two multivalue fields from each event. Let's say the strings are "AAA-" and "BBB-". Each string is followed by a number after the hyphen. An event will have one or both of these strings and possibly multiples of each, hence multivalue. I can pipe the search to a rex command (e.g. |rex max_match=0 "(?AAA-[0-9]+)") which gets me the multivalues of AAA- for each event but how can I include BBB- if it exists in the event as well, or vice versa ?

Thanks,
W

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".

| rex max_match=0  "(?<foo>(?:AAA|BBB)-[0-9]+)"

You can use regex101.com to test possible regex strings against sample data.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you want use rex to match either of two strings, use a '|'. This string should match either "AAA-1" or "BBB-1".

| rex max_match=0  "(?<foo>(?:AAA|BBB)-[0-9]+)"

You can use regex101.com to test possible regex strings against sample data.

---
If this reply helps you, Karma would be appreciated.
0 Karma

wkassel
New Member

Brilliant! I was trying to get two multivalue fields extracted but no reason they can't be in one field in this case. Great idea! Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is solved, please accept the answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...