topic Re: How to extract all values after "," in Splunk Search

How to extract all values after ","

braicu — Thu, 06 Jun 2019 13:29:26 GMT

Hello all ,
Please help me to extract all values from this field :

arn:aws:iam::aws:policy/AmazonEC2FullAccess,AmazonEC2FullAccess
arn:aws:iam::aws:policy/CloudWatchActionsEC2Access,CloudWatchActionsEC2Access
arn:aws:iam::aws:policy/AmazonSNSReadOnlyAccess,AmazonSNSReadOnlyAccess
arn:aws:iam::aws:policy/CloudWatchLogsFullAccess,CloudWatchLogsFullAccess
arn:aws:iam::aws:policy/AmazonSSMFullAccess,AmazonSSMFullAccess
arn:aws:iam::aws:policy/CloudWatchEventsFullAccess,CloudWatchEventsFullAccess

I am not sure why are shown the policies twice, but I need the new column to be :

AmazonEC2FullAccess
CloudWatchActionsEC2Access
AmazonSNSReadOnlyAccess
CloudWatchLogsFullAccess
AmazonSSMFullAccess
CloudWatchEventsFullAccess

I used | rex max_match=0 field=attachedPolicies "(?(?<=,)[^\/]+$)" , but it is not working it extract me the last value, and I need all the values of the field:
CloudWatchEventsFullAccess
Please help.

Re: How to extract all values after ","

braicu — Thu, 06 Jun 2019 13:36:04 GMT

I used this and not working :

Re: How to extract all values after ","

VatsalJagani — Thu, 06 Jun 2019 13:40:18 GMT

@braicu

You have not specified field name that will be extracted. Try: | rex max_match=0 field=attachedPolicies ".*\/(?<new_field>.*)".
Please check here: https://regex101.com/r/nyQXnb/1

Hope this helps!!!

Re: How to extract all values after ","

braicu — Thu, 06 Jun 2019 13:48:25 GMT

Thank you so much , it worked !