Splunk Search

problem extracting all occurrences of name values

cwi
Engager

I have a reoccurring line in a multi-line event of the form:

<td> someName someValue someUnits

I'm trying to save each occurrence of this someName someValue someUnits set, but only the last one is saved. I am extracting these with:

[gztd]
REGEX = ^.*<td>\s+(\S+)\s+(\S+)\s+(\S+)
FORMAT = td_name::$1 td_val::$2 td_units::$3
MV_ADD = true

So, for example if I have:

<td> eff 80 %

<td> rate 47 GB

I only get "rate" for td_name and "47" for td_val and never see the "eff" value. What I want to be able to create is a table for each occurrance.

Thx.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

View solution in original post

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

cwi
Engager

Hi,

That did the trick. Can't say I understand quite yet why the greedy match only gets the last matching set, but you were spot on.

Thanks,
Craig

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...