topic Re: How to extract multiple values from a single value in a field in Splunk Search

How to extract multiple values from a single value in a field?

xoamanda12xo — Thu, 26 May 2022 20:11:36 GMT

I have a field called "Risk Type" that has categorical data associated with the type of risk of an event. For example, for one event it might say "Type - Network", but for another event that has more than one risk type it will say "Type - Network Type - USB Type - Data" where the three risk types are in a single value. What I want to do is to extract each type as a separate value, so for event X there would be three entries for each type. Ex: Event X Type - Network

Event X Type - USB

Event X Type - Data

I tried doing mvexpand but this did not separate each type into multiple values. I also thought of using the rex command but I do not know what the regular expression would be to do this. How do I accomplish this?

Re: How to extract multiple values from a single value in a field

richgalloway — Wed, 25 May 2022 19:26:24 GMT

The rex command will work. Just provide a regex for a single match and include the max_match=0 option and rex will return multiple hits.

| rex max_match=0 field='Risk Type' "Type - (?<riskType>\w+)"

Re: How to extract multiple values from a single value in a field?

shivanshu1593 — Fri, 27 May 2022 09:58:16 GMT

Try the following. Should give you what you're looking for.

| rex max_match=0 field=risk_type "(?<risk_type>Type(?:(?!Type)[\s\S])*)" | mvexpand risk_type

###If this helps, kindly consider an upvote/accepting as an answer###

Re: How to extract multiple values from a single value in a field

xoamanda12xo — Thu, 26 May 2022 20:05:06 GMT

Thanks, this helped alot. Do you know how to extract a sentence? For example if the risk type was Type - Monitor User Activity Type - USB I would want a value with: "Type - Monitor User Activity" and "Type - USB". This solution only gives me "Type - Monitor" in this scenario

Re: How to extract multiple values from a single value in a field

shivanshu1593 — Fri, 27 May 2022 09:57:56 GMT

I've updated the regex above. Please try that. Should extract the sentences that you listed as examples. If it needs more modification, kindly share some sample data to create an accurate regex.

###If it helps, kindly consider mark as accepted answer###