Preserving dual values for a field in parser function extract mode.
i am using parser function in extract mode for a key value pair data source. What I noticed is that, some of the events have two values for the same field `rule_uid = "1234556" | rule_uid = "78938794"` . Cribl seem to be keeping the second value for rule_uid field. What is a right way to preseve both the values for a field? I wonder if parser is the right choice for this.
Answers
-
Parser keeps the last value found
0 -
You could use Regex which would extract an array of matches.
0 -
okay, let me try that
0 -
Thank you David
0 -
<@U01C35EMQ01> were you suggesting to use Type = Regular expression in the parser function?
0 -
No, using the Regular Expression Function
0 -
ok
0 -
We have name value support to auto create keys from the values.
0 -
i was testing out the regular expression Type in parser and that seem to be working out as well
0 -
There is no RegEx type I am aware of in the Parser Function?
0 -
If you are referring to JSON, then you will also lose key values as you saw when the key is the same.
0 -
0
0 -
i was talking about this
0 -
Ah, that is the new 4.1 enhancement to Parser right?
0 -
Not sure when this was released, very useful though!
0 -
It is basically the Regex Function inside the Parser function right?
0 -
yea, looks like that way
0 -
Did you still need help with that?
0 -
I am good now. Thanks for your help!
0
