Splunk Search

rex multiple matches in single event

surekhasplunk
Communicator

Hi,

I using a query :

index=abc source="unknown.log" "192.0.44.13" | rex "Value 0: (?<device>.*)" | rex "Value 1: (?<ip>.*)"  | stats count by device ip

And this gives me only 2 results whereas i have multiple results.

The only problem is all the matches are in single event. which looks like below.

Wed Aug 21 18:34:57 2019: Unknown trap abc at: 
Value 0: abc
Value 1: 192.2.86.53
Value 2: 
Value 3: 
Value 4:
Value 5: 
Value 6: 
Value 7: 
Value 8: 
Value 9: 
Value 10: 
Wed Aug 21 18:34:57 2019: Unknown trap abc at: 
Value 0: xyz
Value 1: 192.2.87.42
Value 2: 
Value 3: 
Value 4:
Value 5: 
Value 6: 
Value 7: 
Value 8: 
Value 9: 
Value 10: 

As you can see here since the at the same time events occur they get merged to a single even and i want all the matches for "Value 0:" and "Value 1:" from the single event.

The query which i have pasted works and fetches me only the first match not all.

Please help.

Tags (3)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi,

Try

     index=abc source="unknown.log" "192.0.44.13" | rex max_match=0 "Value 0: (?<device>.*)" | rex max_match=0 "Value 1: (?<ip>.*)"  | stats count by device ip

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi surekhasplunk,
is it possible for you divide your event in different ones? they seem to be different events.

Anyway, you can extract more values for each field but all the values are in the same field, you haven't different rows, so when you try to use stats you haven't a count for each value.
in other words, you'll have something like this

_time                    message             Value_0   Value_1
Wed Aug 21 18:34:57 2019 Unknown trap abc at abc       192.2.86.53
Wed Aug 21 18:34:57 2019 Unknown trap abc at xyz        192.2.87.42

but both the values are in the same field value, this means that you have to use also mvexpand command.
Try something like this:

 index=abc source="unknown.log" "192.0.44.13" 
| rex max_match=0 "Value 0: (?<device>.*)" 
| rex max_match=0 "Value 1: (?<ip>.*)"  
| mvexpand device
| mvexpand ip
| stats count by device ip

Bye.
Giuseppe

0 Karma

harsmarvania57
Ultra Champion

Hi,

Try

     index=abc source="unknown.log" "192.0.44.13" | rex max_match=0 "Value 0: (?<device>.*)" | rex max_match=0 "Value 1: (?<ip>.*)"  | stats count by device ip
0 Karma

surekhasplunk
Communicator

Hi @harsmarvania57

It worked like magic but whats the logic behind using it ? Can you please explain.

Thanks

0 Karma

harsmarvania57
Ultra Champion

max_match=0 in rex command will match same regex N number of times.

0 Karma

surekhasplunk
Communicator

ok... thanks a ton 🙂 @harsmarvania57

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...