topic Re: How to extract repeated field values in same event? in Splunk Search

How to extract repeated field values in same event?

rajs115 — Fri, 05 Nov 2021 11:08:14 GMT

Hi Guys, I am new to splunk. I need to run a query to extract the system name value which is repeated twice in the same log event. Logs in one event are: user: user1 system: system1 user:user2 system: system2 output should look like below: output1 output2 system1 system2 cheers.

Re: How to extract repeated field values in same event?

rajs115 — Fri, 05 Nov 2021 11:17:19 GMT

Logs in one event are: user: user1 system: system1 user:user2 system: system2 output should look like below: output1 output2 system1 system2

Re: How to extract repeated field values in same event?

ITWhisperer — Fri, 05 Nov 2021 11:46:57 GMT

| rex max_match=2 "system:\s(?<system>[\S]+)" | eval system1=mvindex(system,0) | eval system2=mvindex(system,1)

Re: How to extract repeated field values in same event?

rajs115 — Fri, 05 Nov 2021 12:03:10 GMT

@ITWhisperer ,

Logs in one event are:

user: user1

system: system1

user:user2

system: system2

output should look like below:

output1 output2

system1 system2

I tried as you suggested. Not returning any values.

Re: How to extract repeated field values in same event?

ITWhisperer — Fri, 05 Nov 2021 12:52:32 GMT

Can you share the raw events in a code block </>

Re: How to extract repeated field values in same event?

rajs115 — Fri, 05 Nov 2021 12:55:21 GMT

@ITWhisperer ,

Its working now. Made a slight change from your command. Not sure it its appropriate or not. is there any way we can compare these two values or same or not (if system1=system2)

| rex max_match=2 "system:\s(?<system>[\S]+)" | eval system1=mvindex(system,-1) | eval system2=mvindex(system,0)