Splunk Search

problem extracting all occurrences of name values

cwi
Engager

I have a reoccurring line in a multi-line event of the form:

<td> someName someValue someUnits

I'm trying to save each occurrence of this someName someValue someUnits set, but only the last one is saved. I am extracting these with:

[gztd]
REGEX = ^.*<td>\s+(\S+)\s+(\S+)\s+(\S+)
FORMAT = td_name::$1 td_val::$2 td_units::$3
MV_ADD = true

So, for example if I have:

<td> eff 80 %

<td> rate 47 GB

I only get "rate" for td_name and "47" for td_val and never see the "eff" value. What I want to be able to create is a table for each occurrance.

Thx.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

View solution in original post

Ayn
Legend

I think the problem here is your regex. You're specifying it to match at the beginning of the event (^), then perform a greedy match (.*) that will consume as much as it can while still satisfying the rest of the conditions in the regex. So in your case it will match all text right until the last group of <td>\s+(\S+)\s+(\S+)\s+(\S+), and so this group is the only one that you will get any values for.

My suggestion on how you could change the regex is to simply remove ^.* at the beginning.

cwi
Engager

Hi,

That did the trick. Can't say I understand quite yet why the greedy match only gets the last matching set, but you were spot on.

Thanks,
Craig

0 Karma
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...