I have an extraction that retrieves all the error_reason's in a long string that are separated by a substring err_sep
Example long_error_string:
"Blah blah blah error_reason=divided by zero err_sep error_reason=#num is bad$$$ err_sep error_reason=Infinite loop! err_sep"
This regex works perfectly and creates multiple error_reasons.
| rex field=long_error_string "error_reason=(?P<error_reason>.*?)err_sep" max_match=9999
I was wondering if I can replicate the same behavior using Splunk's field extraction. Without the max_match, it only gets one result and I want to get them all. I am guessing I am missing some simple setting.
Thanks.
If you're looking for saving this field extraction, see below link
Oh I see that there is a "create multivalue button" in transforms. I'll try that out - thanks!