topic Re: How can I use regex to list a table? in Getting Data In

How can I use regex to list a table?

jacknguyen — Tue, 04 Apr 2023 18:31:28 GMT

I have a event like this:

I want to list a table following CLIENT_LIST. For example:

ip_vpn name_vpn time_vpn

10.10.0.20 louis_tran Tue Apr 4 9:21:41 2023

10.0.0.21 wanki_trinh Tue Apr 4 9:15:02 2023

---------------------

Anyone have any idea

ITWhisperer — Tue, 04 Apr 2023 07:55:42 GMT

jacknguyen — Wed, 05 Apr 2023 01:44:43 GMT

the table show nothing

bowesmana — Wed, 05 Apr 2023 03:52:37 GMT

You have a space in your rex statement after CLIENT_LIST,

You should have

CLIENT_LIST,(?<

you have

CLIENT_LIST, (?<

jacknguyen — Wed, 05 Apr 2023 04:54:04 GMT

it works. thank you. How ever the table like this:

And I just want splunk show the latest event and mvexpand it like this:

I try to use ||stats latest but its not working. Do you know how to do this