Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Multi-value Field extraction

$
0
0

Hello,

I would like to create a multi-value field for my data, how can i do that?

here's a sample of my data (Starts at QAM)

event1 = QAM 32209 Prog 238 Path PATH_MW

event2 = QAM 23001 Prog 25 Path PATH_MG PATH_VERTE

event3 = QAM 46201 Prog 180 Path PATH_MD_1 PATH_JAUNE

The field i am trying to extract is Path but as you can see in the sample above, path can have a single value in the case of event1(PATH_MW) or multiple values in the case of event2 (PATH _MG PATH _VERTE) and event3 (PATH _MD _1 PATH _JAUNE)

This regular expression finds them but considers multiple values as one (?i) Path (?P<fieldname>[a-z_]+.[a-z_])

Here the values for event 2 and 3 are considered as one even if we have two values, what can i do so that it stores the two values in the path field for the same event but see them as two different values.

Thank you in advance.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>