Splunk Search

problem extracting all occurrences of name values

cwi
Engager

I have a reoccurring line in a multi-line event of the form:

<td> someName someValue someUnits

I'm trying to save each occurrence of this someName someValue someUnits set, but only the last one is saved. I am extracting these with:

[gztd]
REGEX = ^.*<td>\s+(\S+)\s+(\S+)\s+(\S+)
FORMAT = td_name::$1 td_val::$2 td_units::$3
MV_ADD = true

So, for example if I have:

<td> eff 80 %

<td> rate 47 GB

I only get "rate" for td_name and "47" for td_val and never see the "eff" value. What I want to be able to create is a table for each occurrance.

Thx.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

View solution in original post

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

cwi
Engager

Hi,

That did the trick. Can't say I understand quite yet why the greedy match only gets the last matching set, but you were spot on.

Thanks,
Craig

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...