Here's an example of my log:
zone name PAERSCTVIH025_XIV02_z vsan 2542
attribute broadcast
fcalias name PACTMXIV02_P3_M789 vsan 2542
pwwn 50:01:73:80:61:b1:01:72
pwwn 50:01:73:80:61:b1:01:82
pwwn 50:01:73:80:61:b1:01:92
fcalias name PAERSCTVIH025_fc vsan 2542
pwwn 50:01:43:80:05:6b:87:d2
I'm using the "Extract Fields" interface to try to assign field names to some of the data in the entry.
There are two things I'd like to do, not sure if it is possible to do them both.. But I'd like to try.
First one would be to just pull all of the WWNs from the event and put them in a multi-value key.
so I'd like to see something like:
pwwn = "50:01:73:80:61:b1:01:72", pwwn = "50:01:73:80:61:b1:01:82", etc..
In my search results. That way I can search for pwwn = "something", and get that back.
I have this regex for my field extraction:
pwwn (?P<FIELDNAME>[^ ]+)
But when I run the preview, it only highlights the first match in each event. I tried saving it and seeing if it behaved any differently, but it didn't.
Is there a way to specify a regex that'd match every match inside an event, instead of just the first?
If you're using rex within the search, yes, you just add max_match=100
to the rex command
It you're adding extractions to props.conf its more complicated.
see this
You need to break out the extract field of pwwn, put it in transforms.conf and add MVADD = true
Post the config you have already if you need any help
corrected - thanks Ayn
It's max_matches
(with the underscore) I believe.