I have an event with a field like this: ids="ID-120-1, ID-141-5, ID-92-5, N/A"
I'd like to extract the field and only keep IDs (i.e. I don't want the "N/A" value).
I have a transforms entry like this:
and my props.conf
This isn't working as I would hope though. I'm only getting the first ID. What do I need to do to get all of the IDs added to the id field?
Looks like this is the solution: http://answers.splunk.com/questions/9853/multivalue-field-regex-question/9875#9875
I don't think you need the last plus sign.
answered 12 Dec '10, 22:19