Splunk Search

problem extracting all occurrences of name values

cwi
Engager

I have a reoccurring line in a multi-line event of the form:

<td> someName someValue someUnits

I'm trying to save each occurrence of this someName someValue someUnits set, but only the last one is saved. I am extracting these with:

[gztd]
REGEX = ^.*<td>\s+(\S+)\s+(\S+)\s+(\S+)
FORMAT = td_name::$1 td_val::$2 td_units::$3
MV_ADD = true

So, for example if I have:

<td> eff 80 %

<td> rate 47 GB

I only get "rate" for td_name and "47" for td_val and never see the "eff" value. What I want to be able to create is a table for each occurrance.

Thx.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

View solution in original post

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

cwi
Engager

Hi,

That did the trick. Can't say I understand quite yet why the greedy match only gets the last matching set, but you were spot on.

Thanks,
Craig

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...