How to extract fields at search-time from a multivalue query string?

[bkchung]

Using sourcetype="localapache", extracting fields from the following event only recognizes somevalues but not somevalues2:

::1 - - 2014-10-03 16:10:27.444 Pacific Daylight Time 80 "GET /blah?wp={somevalues}&wp={somevalues2}&more={someother} HTTP/1.1" "-" 204 - "-" 1000

I'm doing the following:
sourcetype="localapache" source=access "GET /blah" | fields + wp | rex fields = wp "{...(?<something>...}" | table wp, something

Both the names of the pair is "wp". Is there any workaround for this?

(Edited some formatting problems with amp,gt,lt, etc.)

[somesoni2]

Try this

sourcetype="localapache" source=access "GET /blah"  | rex field=wp max_match=0 "wp=(?<something>\w+)" | table something

[bkchung]

Got your point. Yes, "wp" will be "somevalues" assuming that "something" is "\w+". But this, I would need to rewrite the regex to parse the query strings case by case rather than rely on the existing auto field extraction to treat multivalue cases which is useful if you don't know the fields and presumed values. I was thinking there might be a workaround to do that with "fields + wp" (also for performance).

[somesoni2]

Remove field=wp from above and try again.

[bkchung]

I did try max_match=0 but it didn't work for me.