Splunk Search

How do we convert rex into makemv?

ddrillic
Ultra Champion

The following | rex "^(?:[^,\n]*,){8}\"\w+\":\"/(?P<apiURL3>\w+/\w+/\w+/\w+\.\d+/\w+\.\w+)" produces for us the desired apiURL3 field. However, we have multiple instances of this field within the event. How can we use the makemv tokenizer command (or anything else) to produce this set of fields?

Btw, we also get the following information message - Cannot get username when all users are selected....

0 Karma

elliotproebstel
Champion

If the regular expression will correctly match all of the instances of apiURL3, then you can simply add max_match=x, where x is the maximum number of matches you expect. So it would look like this for up to 1000 matches:
| rex max_match=1000 "^(?:[^,\n]*,){8}\"\w+\":\"/(?P<apiURL3>\w+/\w+/\w+/\w+\.\d+/\w+\.\w+)"

This will produce a multivalue field called apiURL3.

Here's some more info about options for rex:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Rex

ddrillic
Ultra Champion

No luck with max_match=1000

0 Karma

elliotproebstel
Champion

That suggests to me that the regular expression is structured in such a way that it only matches on one of the instances of apiURL3. Could you post some of the source data, so I can help you adjust the regex?

0 Karma

nileena
Path Finder

Ya, if max_match is not working then the regular expression might be the issue.
The regex starts with a caret (^), which implies that it will only match when it encounters the start of a new line. Is that true for the event?

elliotproebstel
Champion

Ha, good catch @nileena. There is no chance, @ddrillic, that this regex will match multiple instances. At a minimum, try taking out the caret to see if it works. If not, I'm happy to help look at some sample data and see how to restructure the regex.

lfedak_splunk
Splunk Employee
Splunk Employee

Awesome collaboration on this @ddrillic , @micahkemp, @elliotproebstel, and @nileena! Hopefully that resolves the issue.

0 Karma

ddrillic
Ultra Champion

Makes perfect sense that the regex is the issue. I removed the ^ from it without much success. I'll check it more...

0 Karma

micahkemp
Champion

Set max_match to have rex return multivalue fields:

| rex max_match=0 "^(?:[^,\n]*,){8}\"\w+\":\"/(?P<apiURL3>\w+/\w+/\w+/\w+\.\d+/\w+\.\w+)"

ddrillic
Ultra Champion

No luck with max_match=0.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...