Splunk Search

How do I save my rex statement as a field extraction?

ifeldshteyn
Communicator

I have an extraction that retrieves all the error_reason's in a long string that are separated by a substring err_sep

Example long_error_string:

"Blah blah blah error_reason=divided by zero err_sep error_reason=#num is bad$$$ err_sep error_reason=Infinite loop! err_sep"

This regex works perfectly and creates multiple error_reasons.

| rex field=long_error_string "error_reason=(?P<error_reason>.*?)err_sep" max_match=9999

I was wondering if I can replicate the same behavior using Splunk's field extraction. Without the max_match, it only gets one result and I want to get them all. I am guessing I am missing some simple setting.

Thanks.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If you're looking for saving this field extraction, see below link

http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Managefieldtransforms#Review_and_update_se...

ifeldshteyn
Communicator

Oh I see that there is a "create multivalue button" in transforms. I'll try that out - thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...