unable to extract all matching values in a single line; the interesting field only captures first matching value.

[syjayaraj]

The string is a single line, i am unable to extract all matching value in this line.
The interesting fields that Splunk has, it extracts only name1 for e.g, name2, name3 and name4 are not being extracted.
may i request your help.

SNMPVariable value='name1' (oid='enterprises.14179.2.2.1.1.3.0.39.227.7.142.160', oid_index='', snmp_type='OCTETSTR'), 
SNMPVariable value='name2' (oid='enterprises.14179.2.2.1.1.3.0.163.142.226.49.48', oid_index='', snmp_type='OCTETSTR'), 
SNMPVariable value='name3' (oid='enterprises.14179.2.2.1.1.3.160.35.159.93.36.0', oid_index='', snmp_type='OCTETSTR'), 
SNMPVariable value='name4' (oid='enterprises.14179.2.2.1.1.3.160.35.159.93.55.112', oid_index='', snmp_type='OCTETSTR')

[somesoni2]

Splunk's automatic field extraction only captures single valued fields. If your data has multiple values for same field, you'd need to setup custom, multivalued field extraction for the same.
One method is using fields.conf: http://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/ConfigureSplunktoparsemulti-valuefields

Other method is using transforms.conf: https://docs.splunk.com/Documentation/Splunk/7.1.2/Knowledge/Exampleconfigurationsusingfieldtransfor...

[horsefez]

Hi @syjayaraj,
I don't believe that the name fields are static values and you are more going into a "Key-Value" extraction, but still I wanted to provide you with a solution for a static approach in splunk SPL.

| rex field=data max_match=0 ("value='name1'\s\((?<name1>[^\)]+)\)|value='name2'\s\((?<name2>[^\)]+)\)|value='name3'\s\((?<name3>[^\)]+)\)|value='name4'\s\((?<name4>[^\)]+)\)")

You might need to change the field=data to field=_raw in your case.

[horsefez]

Can you please be a bit more specific on the actual values that get extracted @syjayaraj.

Also I need to know if you are trying to extract this data at index-time. (when you index the data) or at search time (when you search on the data, e.g. the | rex - command)