topic Re: Extract Multiple Values to Same Field in Splunk Search

How to extract multiple values to same field?

CybSec1 — Thu, 08 Sep 2022 16:47:31 GMT

Hello,

I have logs like :

samples={'xxxxxxx' : {'111' :{'222' :{'333'}}}}{'yyyyyyy'{'444'}}{'zzzzzzz'}

I need to take all words to one field like ; my field : 'xxxxxxx','yyyyyyy','zzzzzzz'

Thank you,

Re: Extract Multiple Values to Same Field

gcusello — Thu, 08 Sep 2022 08:25:58 GMT

Hi @CybSec1 ,

your log seems to be a json file, have you tried with the spath command?

it extract all fields from json files.

For more information see at https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Spath

then you can use your values in your searches.

Ciao.

Giuseppe

Re: Extract Multiple Values to Same Field

ITWhisperer — Thu, 08 Sep 2022 08:27:58 GMT

| rex mode=sed "s/[^[:alpha:]']+//g s/''/','/g s/'',//g"