one event one filed multi value

[crazyeva]

hello
I have my log form as multi lines breaked with an empty line
thanks to ziegfried， I have devided each event successfully with his help
now I want to extract a field, in each event, may covers more than one value. 1,2 maybe 3 of them, same REX.

I find slpunk can pick out the first value which match the REX express, the others are dropped.
Can splunk extract multi values in one event with one REGEX or one FIELD name?
Thank you!

[crazyeva]

Thank you very much

[kristian_kolb]

see example in a previous post.

http://answers.splunk.com/answers/45116/xml-field-extraction?page=1&focusedAnswerId=45126#45126

Hope this helps,

K

[0waste_splunk]

@kristian.kolb.

can you please explain in detail with some example?

thanks

[gkanapathy · Accepted solution]

You should look at the max_match parameter of the rex command.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex

[crazyeva]

Thank you very mutch.
It is realy a long cause to study on splunk.

[Ayn]

Check kristian.kolb's comment.

[crazyeva]

is there any way for pre-extraction
like some parameters in props.conf or transforms.conf?

[kristian_kolb]

Check out how to make multi-valued extraction through MV_ADD in transforms.conf