Regex Extract function extract fields with regex named groups. (In Splunk these will be index-time fields). Fields that start with
__ (double underscore) are special fields in Cribl. They are ephemeral and can be used by any function downstream but will not be added to events and will not exit the pipeline.
Filter: Filter expression (JS) that selects data to be fed through the function. Defaults to empty - all events will be evaluated.
Regex: Regex literal with named capturing groups, e.g.
(?<foo>bar) or special
_VALUE_N capturing groups which extract both name and value of a field e.g.,
(?<_NAME_0>[^\s=]+)=(?<_VALUE_0>[^\s]+). Defaults to empty. See Examples below.
- Max Exec: The maximum number of times to apply the Regex to source field, used by
_VALUE_Ncapturing groups. Named capturing groups will always use a value of 1. Defaults to 100.
Assume a simple event that looks like this:
metric1=23 metric2=42 dc=23 abc=xyz
- Extract only the
- Extract all k=v pairs: