topic Capture multiple values of same pattern in an event in Splunk Search

Capture multiple values of same pattern in an event

nihvk — Wed, 27 Sep 2023 09:13:12 GMT

How do we capture multiple URLs in a single event?

Log1:

Log2:

Currently I'm using below regex which captures only one URL,

| rex field=_raw ".*\"(?<URL>((http|https):\/\/(\S+|\d+\.\d+\.\d+\.\d+\S+)))\""

Need all the URLs in the output.

ITWhisperer — Wed, 27 Sep 2023 09:41:28 GMT

Try this

| rex max_match=0 field=_raw ".*\"(?<URL>((http|https):\/\/(\S+|\d+\.\d+\.\d+\.\d+\S+)))\""

nihvk — Wed, 27 Sep 2023 09:49:23 GMT

I'm afraid, it still gives a single value output like this,

URL

ITWhisperer — Wed, 27 Sep 2023 09:53:01 GMT

Try without the greedy match at the beginning

| rex max_match=0 field=_raw "\"(?<URL>((http|https):\/\/(\S+|\d+\.\d+\.\d+\.\d+\S+)))\""

nihvk — Wed, 27 Sep 2023 09:57:43 GMT

Fantastic! It worked. Thanks for the solution.