Hello Splunk experts,
Can Splunk extract more then 6 regular expression in the same time?
Example:
sourcetype="imap"
| rex field=_raw "(?ms)(?
| rex field=capture "-(?
| rex field=dash "-(?
| rex field=seconddash "-(?
| rex field=thirddash "-(?
| rex field=fourthdash "-(?
| rex field=fifthdash "-(?
| rex field=sixdash "-(?
The sevendash field is not appearing while i need to continue till the end and choose the last fields.
I am not exactly sure what you are trying to accomplish here. Can you show a sample of the raw event this would go against?
Would it be easier to do the regex all in one rex command?
Does the event have "-" seperated fields? If so, would it make sense to use a transform using DELIMS?
You can extract more than 6 fields.
Can you give a redacted sample of the events you're attempting to parse - the way you've approached this doesn't seem ideal...