Splunk Search

Multivalue field regex question

mw
Splunk Employee
Splunk Employee

I have a field like this:

... group="Group One,Group2,Some Other Group" ...

Using 'makemv delim="," group' is easy and works great, but I'm having a hard time getting the right regex in transforms to do it automatically. I've tried a number of things, but they all end up being too greedy, or just not working. Based on my last question here, I tried things like this:

REGEX = (?:(?:group=\")|(?:,))(?<group>(?:[^,]+)*)
MV_ADD = true

I've also tried:

REGEX = (([^,]+)*)
SOURCE_KEY = group

I've tried enough things that I've lost track. I'm sure this should be quite easy, but it's not. Any help?

Tags (2)
0 Karma
1 Solution

araitz
Splunk Employee
Splunk Employee

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

View solution in original post

araitz
Splunk Employee
Splunk Employee

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

blurblebot
Communicator

Challenge bonus extra credit question: What should my transforms.conf regex look like for the same line of data mw specified, but without the quotation marks? Betcha can't do it.

0 Karma

Dan
Splunk Employee
Splunk Employee

Fiddled with it for a little while, but didn't get too much farther. I added some ingredients like positive lookahead (?=) and non-greedy wildcard (.*?). Taking a step back, I'm not sure if regex is the right way to go about this. Isn't there an easier way to persist "makemv delim=" to the configs? If not, there should be.

(?=group=\")(?:(?:group=\")|(?:.*,))(?<group>[^,]*?)(?:\")

mw
Splunk Employee
Splunk Employee

That does seem to work a bit better, but still seems unreliable. I have a couple fields like this and it seems to work with my group data, but not with my site data which is formatted the same and I would expect would work properly with the same regex. Agreed. I have to think there's something built-in that I've missed here. Would be really nice if this worked in this case, but it doesn't seem to or I've missed something:

DELIMS = "," 
SOURCE_KEY = group 
MV_ADD = true
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...