How to extract all matching values from an event using regex

Question

Hi,

iam trying to extract certain values from my log files which i have given below 1st event at x.x.x.x.x.x(1) at x.x.x.x.x.x.x.x(2) at X.x.x.x.x.x.x.x.xx(3) ........... 2nd event at x.x.x.x.x.x(4) at x.x.x.x.x.x.x.x(5) at X.x.x.x.x.x.x.x.xx(6) ............... ......... The issue iam facing is iam getting only first line of every event starting with "at", not the all lines in one event itself.I want all the values after "at" in each events" the output iam getting is like this

x.x.x.x.x.x(1) x.x.x.x.x.x.x.x(5)

This is the regex iam using

rex field=_raw "ats(?<value>.*)s"

Accepted Answer

6

rex only matches one time by default. This behaviour is controlled by the max_match parameter, so if you want more matches just set it to something higher:

... | rex max_match=10 field=_raw "at\s(?<value>.*?)\s"

link

answered 05 May '12, 03:51

Ayn
25.2k●3●7●17
accept rate: 41%

Thanks Ayn,Its working fine..........

(06 May '12, 21:37) john

How to extract all matching values from an event using regex

Follow this question

Splunk Resources

Related questions