Multivalue field regex question

Question

I have a field like this:

... group="Group One,Group2,Some Other Group" ...

Using 'makemv delim="," group' is easy and works great, but I'm having a hard time getting the right regex in transforms to do it automatically. I've tried a number of things, but they all end up being too greedy, or just not working. Based on my last question here, I tried things like this:

REGEX = (?:(?:group=\")|(?:,))(?<group>(?:[^,]+)*)
MV_ADD = true

I've also tried:

REGEX = (([^,]+)*)
SOURCE_KEY = group

I've tried enough things that I've lost track. I'm sure this should be quite easy, but it's not. Any help?

Accepted Answer

5

The correct method to make this field multivalued is to use fields.conf:

props.conf:

[bigfix]
REPORT-bf = mv_group

transforms.conf:

[mv_group]
REGEX = group\=\"([^\"]+)
FORMAT = group::$1

fields.conf:

[group]
TOKENIZER = ([^\,]+)

link

answered 14 Dec '10, 19:54

araitz ♦
8.0k●3●10●25
accept rate: 45%

Challenge bonus extra credit question: What should my transforms.conf regex look like for the same line of data mw specified, but without the quotation marks? Betcha can't do it.

(18 Aug '11, 08:32) blurblebot

Answer 2

0

Fiddled with it for a little while, but didn't get too much farther. I added some ingredients like positive lookahead (?=) and non-greedy wildcard (.*?). Taking a step back, I'm not sure if regex is the right way to go about this. Isn't there an easier way to persist "makemv delim=" to the configs? If not, there should be.

(?=group=\")(?:(?:group=\")|(?:.*,))(?<group>[^,]*?)(?:\")

link

answered 14 Dec '10, 19:09

Dan ♦
1.5k●4●6●26
accept rate: 36%

That does seem to work a bit better, but still seems unreliable. I have a couple fields like this and it seems to work with my group data, but not with my site data which is formatted the same and I would expect would work properly with the same regex. Agreed. I have to think there's something built-in that I've missed here. Would be really nice if this worked in this case, but it doesn't seem to or I've missed something:

DELIMS = "," 
SOURCE_KEY = group 
MV_ADD = true

(14 Dec '10, 19:39) mw

Multivalue field regex question

Follow this question

Splunk Resources

Related questions