I am using this rex command
| rex max_match=100 "(?i)<severity>(?P<Severity>[^<]+)"
When I add this to the props.conf like this
EXTRACT-Severity = max_match=100 (?i)<severity>(?P<Severity>[^<]+)
I get no return at all
If I use this in the props.conf
EXTRACT-Severity = (?i)<severity>(?P<Severity>[^<]+)
I only get the first return in the event not all the other possible returns in the event
Can anyone help with this rex conversion to props.conf
props.conf wont understand the max_match parameter, that is specific to the rex command... so you cannot use it there.
Now what do you mean you only get the first return in the event and not all other possible returns? Do you mean in a single event there are multiple Severity levels that could be reported?
If so you could look at using a transform for this...
in transforms.conf :
[get_severity]
REGEX = \<severity\>([^<]+)
FORMAT = Severity::$1
MV_ADD = true
then add in props.conf :
REPORT-severity = get_severity
props.conf wont understand the max_match parameter, that is specific to the rex command... so you cannot use it there.
Now what do you mean you only get the first return in the event and not all other possible returns? Do you mean in a single event there are multiple Severity levels that could be reported?
If so you could look at using a transform for this...
in transforms.conf :
[get_severity]
REGEX = \<severity\>([^<]+)
FORMAT = Severity::$1
MV_ADD = true
then add in props.conf :
REPORT-severity = get_severity
All this stuff is well explained in the docs.
http://docs.splunk.com/Documentation/Splunk/latest/admin/transformsconf
http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf
can u explain the option FORMAT.. how to define that if we have more than one multivalued fields to extract from one event
thank you