<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Need help with Regex in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Need-help-with-Regex/m-p/651259#M225163</link>
    <description>&lt;P&gt;Use max_match=0&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex max_match=0 ...&lt;/LI-CODE&gt;</description>
    <pubDate>Thu, 20 Jul 2023 08:49:12 GMT</pubDate>
    <dc:creator>ITWhisperer</dc:creator>
    <dc:date>2023-07-20T08:49:12Z</dc:date>
    <item>
      <title>Need help with Regex</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-help-with-Regex/m-p/651257#M225161</link>
      <description>&lt;P&gt;Requirement is to fetch values for all&amp;nbsp;agentName and put it in a field.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Tried -&amp;nbsp;'agentName':\s(?&amp;lt;agentname&amp;gt;.*?,) but it pulls only first occurence.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Below is sample:&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;0,1,"[{'active': 0, 'metricsAtStart': 'Jitter: 193.6 ms', 'metricsAtEnd': 'Jitter: 98.8 ms', 'agentId': 280961, 'agentName': 'BR15CORPTE01', 'dateStart': '2023-07-19 18:27:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': '&lt;A href="https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=280961" target="_blank"&gt;https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=280961&lt;/A&gt;'}, {'active': 0, 'metricsAtStart': 'Jitter: 194.2 ms', 'metricsAtEnd': 'Jitter: 1.9 ms', 'agentId': 294526, 'agentName': 'US06CORPTE01', 'dateStart': '2023-07-19 18:23:00', 'dateEnd': '2023-07-19 18:28:00', 'permalink': '&lt;A href="https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=294526" target="_blank"&gt;https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=294526&lt;/A&gt;'}, {'active': 1, 'metricsAtStart': 'Jitter: 100.2 ms', 'metricsAtEnd': '', 'agentId': 294566, 'agentName': 'US22CORPTE01', 'dateStart': '2023-07-19 18:28:00', 'permalink': '&lt;A href="https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=294566" target="_blank"&gt;https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=294566&lt;/A&gt;'}, {'active': 0, 'metricsAtStart': 'Latency: 209 ms', 'metricsAtEnd': 'Latency: 142.9 ms', 'agentId': 337436, 'agentName': 'AR06CORPTE01', 'dateStart': '2023-07-19 18:26:00', 'dateEnd': '2023-07-19 18:27:00', 'permalink': '&lt;A href="https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=337436" target="_blank"&gt;https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203&amp;amp;agentId=337436&lt;/A&gt;'}]",194913203,2023-07-19 18:22:00,"[{'rel': 'related', 'href': '&lt;A href="https://api.thousandeyes.com/v6/tests/3271565" target="_blank"&gt;https://api.thousandeyes.com/v6/tests/3271565&lt;/A&gt;'}, {'rel': 'data', 'href': '&lt;A href="https://api.thousandeyes.com/v6/net/metrics/3271565" target="_blank"&gt;https://api.thousandeyes.com/v6/net/metrics/3271565&lt;/A&gt;'}]",&lt;A href="https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203,((avgLatency" target="_blank"&gt;https://app.thousandeyes.com/alerts/list/?__a=243206&amp;amp;alertId=194913203,((avgLatency&lt;/A&gt; &amp;gt;&lt;/P&gt;</description>
      <pubDate>Thu, 20 Jul 2023 08:47:05 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-help-with-Regex/m-p/651257#M225161</guid>
      <dc:creator>sbhatnagar88</dc:creator>
      <dc:date>2023-07-20T08:47:05Z</dc:date>
    </item>
    <item>
      <title>Re: Need help with Regex</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Need-help-with-Regex/m-p/651259#M225163</link>
      <description>&lt;P&gt;Use max_match=0&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;| rex max_match=0 ...&lt;/LI-CODE&gt;</description>
      <pubDate>Thu, 20 Jul 2023 08:49:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Need-help-with-Regex/m-p/651259#M225163</guid>
      <dc:creator>ITWhisperer</dc:creator>
      <dc:date>2023-07-20T08:49:12Z</dc:date>
    </item>
  </channel>
</rss>

